diff --git a/contrib/rackspace/heat_keystoneclient_v2/tests/test_client.py b/contrib/rackspace/heat_keystoneclient_v2/tests/test_client.py
index f66438ec1d..1b680ce402 100644
--- a/contrib/rackspace/heat_keystoneclient_v2/tests/test_client.py
+++ b/contrib/rackspace/heat_keystoneclient_v2/tests/test_client.py
@@ -36,13 +36,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         dummy_url = 'http://server.test:5000/v2.0'
         cfg.CONF.set_override('auth_uri', dummy_url,
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         cfg.CONF.set_override('admin_user', 'heat',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         cfg.CONF.set_override('admin_password', 'verybadpass',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         cfg.CONF.set_override('admin_tenant_name', 'service',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         self.addCleanup(self.m.VerifyAll)
 
     def _stubs_v2(self, method='token', auth_ok=True, trust_scoped=True,
diff --git a/contrib/rackspace/rackspace/tests/test_rackspace_cloud_server.py b/contrib/rackspace/rackspace/tests/test_rackspace_cloud_server.py
index d7f1828a02..5cb1bb8556 100644
--- a/contrib/rackspace/rackspace/tests/test_rackspace_cloud_server.py
+++ b/contrib/rackspace/rackspace/tests/test_rackspace_cloud_server.py
@@ -64,7 +64,8 @@ cfg.CONF.import_opt('region_name_for_services', 'heat.common.config')
 class CloudServersTest(common.HeatTestCase):
     def setUp(self):
         super(CloudServersTest, self).setUp()
-        cfg.CONF.set_override('region_name_for_services', 'RegionOne')
+        cfg.CONF.set_override('region_name_for_services', 'RegionOne',
+                              enforce_type=True)
         self.ctx = utils.dummy_context()
 
         self.fc = fakes.FakeClient()
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 04653f3049..658d2bfa73 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -49,10 +49,12 @@ sys.path.insert(0, ROOT)
 sys.path.insert(0, BASE_DIR)
 
 cfg.CONF.import_opt('plugin_dirs', 'heat.common.config')
-cfg.CONF.set_override(name='plugin_dirs', override=PLUGIN_DIRS)
+cfg.CONF.set_override(name='plugin_dirs', override=PLUGIN_DIRS,
+                      enforce_type=True)
 
 cfg.CONF.import_opt('environment_dir', 'heat.common.config')
-cfg.CONF.set_override(name='environment_dir', override=TEMP_ENV_DIR)
+cfg.CONF.set_override(name='environment_dir', override=TEMP_ENV_DIR,
+                      enforce_type=True)
 
 # This is required for ReadTheDocs.org, but isn't a bad idea anyway.
 os.environ['DJANGO_SETTINGS_MODULE'] = 'openstack_dashboard.settings'
diff --git a/heat/engine/service.py b/heat/engine/service.py
index 3770191bb4..7f773dd075 100644
--- a/heat/engine/service.py
+++ b/heat/engine/service.py
@@ -403,7 +403,7 @@ class EngineService(service.Service):
         if ((cfg.CONF.database.max_overflow is None) or
                 (cfg.CONF.database.max_overflow < worker_pool_size)):
             cfg.CONF.set_override('max_overflow', worker_pool_size,
-                                  group='database')
+                                  group='database', enforce_type=True)
 
     def _stop_rpc_server(self):
         # Stop rpc connection at first for preventing new requests
diff --git a/heat/tests/api/aws/test_api_ec2token.py b/heat/tests/api/aws/test_api_ec2token.py
index a627706507..1dc1fd3bf6 100644
--- a/heat/tests/api/aws/test_api_ec2token.py
+++ b/heat/tests/api/aws/test_api_ec2token.py
@@ -544,7 +544,7 @@ class Ec2TokenTest(common.HeatTestCase):
         importutils.import_module('keystonemiddleware.auth_token')
         dummy_url = 'http://123:5000/v2.0'
         cfg.CONF.set_override('auth_uri', dummy_url,
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         ec2 = ec2token.EC2Token(app='woot', conf={})
         params = {'AWSAccessKeyId': 'foo', 'Signature': 'xyz'}
         req_env = {'SERVER_NAME': 'heat',
diff --git a/heat/tests/api/openstack_v1/test_stacks.py b/heat/tests/api/openstack_v1/test_stacks.py
index a360a468fd..726c1926c3 100644
--- a/heat/tests/api/openstack_v1/test_stacks.py
+++ b/heat/tests/api/openstack_v1/test_stacks.py
@@ -131,7 +131,7 @@ blarg: wibble
         self.assertRaises(webob.exc.HTTPBadRequest, data.template)
 
     def test_template_exceeds_max_template_size(self):
-        cfg.CONF.set_override('max_template_size', 10)
+        cfg.CONF.set_override('max_template_size', 10, enforce_type=True)
         template = json.dumps(['a'] * cfg.CONF.max_template_size)
         body = {'template': template}
         data = stacks.InstantiationData(body)
@@ -1127,7 +1127,7 @@ class StackControllerTest(tools.ControllerTest, common.HeatTestCase):
         self.m.VerifyAll()
 
     def test_create_err_stack_bad_reqest(self, mock_enforce):
-        cfg.CONF.set_override('debug', True)
+        cfg.CONF.set_override('debug', True, enforce_type=True)
         template = {u'Foo': u'bar'}
         parameters = {u'InstanceType': u'm1.xlarge'}
         body = {'template': template,
diff --git a/heat/tests/api/test_wsgi.py b/heat/tests/api/test_wsgi.py
index 24989c2de7..bb6ba4ec3c 100644
--- a/heat/tests/api/test_wsgi.py
+++ b/heat/tests/api/test_wsgi.py
@@ -391,7 +391,7 @@ class JSONRequestDeserializerTest(common.HeatTestCase):
         self.assertEqual(expected, actual)
 
     def test_from_json_exceeds_max_json_mb(self):
-        cfg.CONF.set_override('max_json_body_size', 10)
+        cfg.CONF.set_override('max_json_body_size', 10, enforce_type=True)
         body = json.dumps(['a'] * cfg.CONF.max_json_body_size)
         self.assertTrue(len(body) > cfg.CONF.max_json_body_size)
         error = self.assertRaises(exception.RequestLimitExceeded,
diff --git a/heat/tests/aws/test_instance.py b/heat/tests/aws/test_instance.py
index 79cb716d7f..b26afc2bb9 100644
--- a/heat/tests/aws/test_instance.py
+++ b/heat/tests/aws/test_instance.py
@@ -579,7 +579,8 @@ class InstancesTest(common.HeatTestCase):
 
     def test_instance_create_with_stack_scheduler_hints(self):
         return_server = self.fc.servers.list()[1]
-        sh.cfg.CONF.set_override('stack_scheduler_hints', True)
+        sh.cfg.CONF.set_override('stack_scheduler_hints', True,
+                                 enforce_type=True)
         # Unroll _create_test_instance, to enable check
         # for addition of heat ids (stack id, resource name)
         stack_name = 'test_instance_create_with_stack_scheduler_hints'
diff --git a/heat/tests/aws/test_loadbalancer.py b/heat/tests/aws/test_loadbalancer.py
index 550956cf0f..7150d12d0c 100644
--- a/heat/tests/aws/test_loadbalancer.py
+++ b/heat/tests/aws/test_loadbalancer.py
@@ -154,7 +154,8 @@ class LoadBalancerTest(common.HeatTestCase):
             rsrc.validate())
 
     def test_loadbalancer_validate_badtemplate(self):
-        cfg.CONF.set_override('loadbalancer_template', '/a/noexist/x.y')
+        cfg.CONF.set_override('loadbalancer_template', '/a/noexist/x.y',
+                              enforce_type=True)
         rsrc = self.setup_loadbalancer()
         self.assertRaises(exception.StackValidationFailed, rsrc.validate)
 
diff --git a/heat/tests/aws/test_volume.py b/heat/tests/aws/test_volume.py
index a566d652da..db7fb92073 100644
--- a/heat/tests/aws/test_volume.py
+++ b/heat/tests/aws/test_volume.py
@@ -181,7 +181,7 @@ class VolumeTest(vt_base.BaseVolumeTest):
     def test_volume_create_error(self):
         fv = vt_base.FakeVolume('creating')
         stack_name = 'test_volume_create_error_stack'
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
 
         self._mock_create_volume(fv, stack_name, final_status='error')
 
@@ -607,7 +607,7 @@ class VolumeTest(vt_base.BaseVolumeTest):
     def test_snapshot_no_volume(self):
         """Test that backup does not start for failed resource."""
         stack_name = 'test_volume_snapshot_novol_stack'
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         fv = self._mock_create_volume(vt_base.FakeVolume('creating'),
                                       stack_name,
                                       final_status='error')
@@ -663,7 +663,7 @@ class VolumeTest(vt_base.BaseVolumeTest):
 
     def test_create_from_snapshot_error(self):
         stack_name = 'test_volume_create_from_snap_err_stack'
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         fv = vt_base.FakeVolume('restoring-backup')
         fvbr = vt_base.FakeBackupRestore('vol-123')
 
diff --git a/heat/tests/clients/test_clients.py b/heat/tests/clients/test_clients.py
index 5ad5d33ea1..344c5c7867 100644
--- a/heat/tests/clients/test_clients.py
+++ b/heat/tests/clients/test_clients.py
@@ -44,12 +44,14 @@ class ClientsTest(common.HeatTestCase):
 
     def test_bad_cloud_backend(self):
         con = mock.Mock()
-        cfg.CONF.set_override('cloud_backend', 'some.weird.object')
+        cfg.CONF.set_override('cloud_backend', 'some.weird.object',
+                              enforce_type=True)
         exc = self.assertRaises(exception.Invalid, clients.Clients, con)
         self.assertIn('Invalid cloud_backend setting in heat.conf detected',
                       six.text_type(exc))
 
-        cfg.CONF.set_override('cloud_backend', 'heat.engine.clients.Clients')
+        cfg.CONF.set_override('cloud_backend', 'heat.engine.clients.Clients',
+                              enforce_type=True)
         exc = self.assertRaises(exception.Invalid, clients.Clients, con)
         self.assertIn('Invalid cloud_backend setting in heat.conf detected',
                       six.text_type(exc))
@@ -100,7 +102,7 @@ class ClientsTest(common.HeatTestCase):
 
     def test_clients_get_heat_cfn_metadata_url_conf(self):
         cfg.CONF.set_override('heat_metadata_server_url',
-                              'http://server.test:123')
+                              'http://server.test:123', enforce_type=True)
         obj = self._client_cfn_url()
         self.assertEqual("http://server.test:123/v1/",
                          obj.get_cfn_metadata_server_url())
@@ -182,11 +184,11 @@ class ClientPluginTest(common.HeatTestCase):
         plugin = FooClientsPlugin(con)
 
         cfg.CONF.set_override('ca_file', '/tmp/bar',
-                              group='clients_heat')
+                              group='clients_heat', enforce_type=True)
         cfg.CONF.set_override('ca_file', '/tmp/foo',
-                              group='clients')
+                              group='clients', enforce_type=True)
         cfg.CONF.set_override('endpoint_type', 'internalURL',
-                              group='clients')
+                              group='clients', enforce_type=True)
 
         # check heat group
         self.assertEqual('/tmp/bar',
@@ -357,7 +359,8 @@ class ClientPluginTest(common.HeatTestCase):
         self.assertRaises(TypeError, client_plugin.ClientPlugin, c)
 
     def test_create_client_on_token_expiration(self):
-        cfg.CONF.set_override('reauthentication_auth_method', 'trusts')
+        cfg.CONF.set_override('reauthentication_auth_method', 'trusts',
+                              enforce_type=True)
         con = mock.Mock()
         con.auth_plugin.auth_ref.will_expire_soon.return_value = False
         plugin = FooClientsPlugin(con)
diff --git a/heat/tests/clients/test_heat_client.py b/heat/tests/clients/test_heat_client.py
index 4e39f6aac4..8ea2db6f51 100644
--- a/heat/tests/clients/test_heat_client.py
+++ b/heat/tests/clients/test_heat_client.py
@@ -55,10 +55,13 @@ class KeystoneClientTest(common.HeatTestCase):
         self.m.StubOutWithMock(ks_auth, 'load_from_conf_options')
 
         cfg.CONF.set_override('auth_uri', 'http://server.test:5000/v2.0',
-                              group='keystone_authtoken')
-        cfg.CONF.set_override('stack_user_domain_id', 'adomain123')
-        cfg.CONF.set_override('stack_domain_admin', 'adminuser123')
-        cfg.CONF.set_override('stack_domain_admin_password', 'adminsecret')
+                              group='keystone_authtoken', enforce_type=True)
+        cfg.CONF.set_override('stack_user_domain_id', 'adomain123',
+                              enforce_type=True)
+        cfg.CONF.set_override('stack_domain_admin', 'adminuser123',
+                              enforce_type=True)
+        cfg.CONF.set_override('stack_domain_admin_password', 'adminsecret',
+                              enforce_type=True)
 
         self.addCleanup(self.m.VerifyAll)
 
@@ -483,7 +486,8 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test create_trust_context with existing trust_id."""
 
         self._stubs_v3(method='trust')
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         self.m.ReplayAll()
 
         ctx = utils.dummy_context()
@@ -513,9 +517,11 @@ class KeystoneClientTest(common.HeatTestCase):
                                                      project_id='42',
                                                      stub_trust_context=True)
 
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         if delegate_roles:
-            cfg.CONF.set_override('trusts_delegated_roles', delegate_roles)
+            cfg.CONF.set_override('trusts_delegated_roles', delegate_roles,
+                                  enforce_type=True)
 
         trustor_roles = ['heat_stack_owner', 'admin', '__member__']
         trustee_roles = delegate_roles or trustor_roles
@@ -552,8 +558,10 @@ class KeystoneClientTest(common.HeatTestCase):
                                                   project_id='42',
                                                   stub_trust_context=True)
 
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
-        cfg.CONF.set_override('trusts_delegated_roles', ['heat_stack_owner'])
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
+        cfg.CONF.set_override('trusts_delegated_roles', ['heat_stack_owner'],
+                              enforce_type=True)
 
         self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
         self.mock_ks_v3_client.trusts.create(
@@ -606,7 +614,8 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test consuming a trust when initializing."""
 
         self._stubs_v3(method='trust')
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         self.m.ReplayAll()
 
         ctx = utils.dummy_context()
@@ -624,7 +633,8 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test consuming a trust when initializing, error scoping."""
 
         self._stubs_v3(method='trust', trust_scoped=False)
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         self.m.ReplayAll()
 
         ctx = utils.dummy_context()
@@ -641,7 +651,8 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test consuming a trust when initializing, impersonation error."""
 
         self._stubs_v3(method='trust', user_id='wrong_user_id')
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         self.m.ReplayAll()
 
         ctx = utils.dummy_context()
@@ -687,7 +698,8 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test delete_trust when deleting trust."""
 
         self._stubs_v3()
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
         self.mock_ks_v3_client.trusts.delete('atrust123').AndReturn(None)
 
@@ -701,7 +713,8 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test delete_trust when trust already deleted."""
 
         self._stubs_v3()
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
         self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
         self.mock_ks_v3_client.trusts.delete('atrust123').AndRaise(
             kc_exception.NotFound)
@@ -1390,7 +1403,8 @@ class KeystoneClientTest(common.HeatTestCase):
         Test that None value is passed as region name if region name is not
         specified in the config file or as one of the arguments.
         """
-        cfg.CONF.set_override('region_name_for_services', None)
+        cfg.CONF.set_override('region_name_for_services', None,
+                              enforce_type=True)
         service_url = 'http://example.com:1234/v1'
         kwargs = {
             'region_name': None
@@ -1403,7 +1417,8 @@ class KeystoneClientTest(common.HeatTestCase):
         Test that region name passed as argument is not override by region name
         specified in the config file.
         """
-        cfg.CONF.set_override('region_name_for_services', 'RegionOne')
+        cfg.CONF.set_override('region_name_for_services', 'RegionOne',
+                              enforce_type=True)
         service_url = 'http://regiontwo.example.com:1234/v1'
         kwargs = {
             'region_name': 'RegionTwo'
@@ -1418,7 +1433,7 @@ class KeystoneClientTest(common.HeatTestCase):
         """
         region_name_for_services = 'RegionOne'
         cfg.CONF.set_override('region_name_for_services',
-                              region_name_for_services)
+                              region_name_for_services, enforce_type=True)
         kwargs = {
             'region_name': region_name_for_services
         }
@@ -1431,7 +1446,8 @@ class KeystoneClientTest(common.HeatTestCase):
         Test that default region name for services from context is passed
         if region name is not specified in arguments.
         """
-        cfg.CONF.set_override('region_name_for_services', 'RegionOne')
+        cfg.CONF.set_override('region_name_for_services', 'RegionOne',
+                              enforce_type=True)
         service_url = 'http://regiontwo.example.com:1234/v1'
         region_name_for_services = 'RegionTwo'
         expected_kwargs = {
@@ -1449,7 +1465,8 @@ class KeystoneClientTest(common.HeatTestCase):
 
 class KeystoneClientTestDomainName(KeystoneClientTest):
     def setUp(self):
-        cfg.CONF.set_override('stack_user_domain_name', 'fake_domain_name')
+        cfg.CONF.set_override('stack_user_domain_name', 'fake_domain_name',
+                              enforce_type=True)
         super(KeystoneClientTestDomainName, self).setUp()
         cfg.CONF.clear_override('stack_user_domain_id')
 
diff --git a/heat/tests/clients/test_nova_client.py b/heat/tests/clients/test_nova_client.py
index ecbe1c9306..c3459688fd 100644
--- a/heat/tests/clients/test_nova_client.py
+++ b/heat/tests/clients/test_nova_client.py
@@ -392,13 +392,14 @@ class NovaClientPluginUserdataTest(NovaClientPluginTestCase):
     def test_build_userdata(self):
         """Tests the build_userdata function."""
         cfg.CONF.set_override('heat_metadata_server_url',
-                              'http://server.test:123')
+                              'http://server.test:123', enforce_type=True)
         cfg.CONF.set_override('heat_watch_server_url',
-                              'http://server.test:345')
+                              'http://server.test:345', enforce_type=True)
         cfg.CONF.set_override('instance_connection_is_secure',
-                              False)
+                              False, enforce_type=True)
         cfg.CONF.set_override(
-            'instance_connection_https_validate_certificates', False)
+            'instance_connection_https_validate_certificates', False,
+            enforce_type=True)
         data = self.nova_plugin.build_userdata({})
         self.assertIn("Content-Type: text/cloud-config;", data)
         self.assertIn("Content-Type: text/cloud-boothook;", data)
@@ -412,9 +413,9 @@ class NovaClientPluginUserdataTest(NovaClientPluginTestCase):
     def test_build_userdata_without_instance_user(self):
         """Don't add a custom instance user when not requested."""
         cfg.CONF.set_override('heat_metadata_server_url',
-                              'http://server.test:123')
+                              'http://server.test:123', enforce_type=True)
         cfg.CONF.set_override('heat_watch_server_url',
-                              'http://server.test:345')
+                              'http://server.test:345', enforce_type=True)
         data = self.nova_plugin.build_userdata({}, instance_user=None)
         self.assertNotIn('user: ', data)
         self.assertNotIn('useradd', data)
@@ -423,9 +424,9 @@ class NovaClientPluginUserdataTest(NovaClientPluginTestCase):
     def test_build_userdata_with_instance_user(self):
         """Add a custom instance user."""
         cfg.CONF.set_override('heat_metadata_server_url',
-                              'http://server.test:123')
+                              'http://server.test:123', enforce_type=True)
         cfg.CONF.set_override('heat_watch_server_url',
-                              'http://server.test:345')
+                              'http://server.test:345', enforce_type=True)
         data = self.nova_plugin.build_userdata({}, instance_user='ec2-user')
         self.assertIn('user: ', data)
         self.assertIn('useradd', data)
diff --git a/heat/tests/common.py b/heat/tests/common.py
index 04626f9e87..19bf07c987 100644
--- a/heat/tests/common.py
+++ b/heat/tests/common.py
@@ -104,7 +104,7 @@ class HeatTestCase(testscenarios.WithScenarios,
                                'environment.d')
 
         cfg.CONF.set_default('environment_dir', env_dir)
-        cfg.CONF.set_override('error_wait_time', None)
+        cfg.CONF.set_override('error_wait_time', None, enforce_type=True)
         self.addCleanup(cfg.CONF.reset)
 
         messaging.setup("fake://", optional=True)
diff --git a/heat/tests/db/test_sqlalchemy_api.py b/heat/tests/db/test_sqlalchemy_api.py
index 010eb915df..4db919ddc6 100644
--- a/heat/tests/db/test_sqlalchemy_api.py
+++ b/heat/tests/db/test_sqlalchemy_api.py
@@ -599,7 +599,8 @@ class SqlAlchemyTest(common.HeatTestCase):
         self.assertEqual(['id'], sort_keys)
 
     def test_stack_get_all_hidden_tags(self):
-        cfg.CONF.set_override('hidden_stack_tags', ['hidden'])
+        cfg.CONF.set_override('hidden_stack_tags', ['hidden'],
+                              enforce_type=True)
 
         stacks = [self._setup_test_stack('stack', x)[1] for x in UUIDs]
         stacks[0].tags = ['hidden']
@@ -709,7 +710,8 @@ class SqlAlchemyTest(common.HeatTestCase):
         self.assertEqual(stacks[0].id, st_db[0].id)
 
     def test_stack_get_all_by_tag_with_show_hidden(self):
-        cfg.CONF.set_override('hidden_stack_tags', ['hidden'])
+        cfg.CONF.set_override('hidden_stack_tags', ['hidden'],
+                              enforce_type=True)
 
         stacks = [self._setup_test_stack('stack', x)[1] for x in UUIDs]
         stacks[0].tags = ['tag1']
@@ -746,7 +748,8 @@ class SqlAlchemyTest(common.HeatTestCase):
         self.assertEqual(3, st_db)
 
     def test_count_all_hidden_tags(self):
-        cfg.CONF.set_override('hidden_stack_tags', ['hidden'])
+        cfg.CONF.set_override('hidden_stack_tags', ['hidden'],
+                              enforce_type=True)
 
         stacks = [self._setup_test_stack('stack', x)[1] for x in UUIDs]
         stacks[0].tags = ['hidden']
@@ -776,7 +779,8 @@ class SqlAlchemyTest(common.HeatTestCase):
         self.assertEqual(2, st_db)
 
     def test_count_all_by_tag_with_show_hidden(self):
-        cfg.CONF.set_override('hidden_stack_tags', ['hidden'])
+        cfg.CONF.set_override('hidden_stack_tags', ['hidden'],
+                              enforce_type=True)
 
         stacks = [self._setup_test_stack('stack', x)[1] for x in UUIDs]
         stacks[0].tags = ['tag1']
diff --git a/heat/tests/engine/service/test_stack_adopt.py b/heat/tests/engine/service/test_stack_adopt.py
index 2c11303a02..273018eae7 100644
--- a/heat/tests/engine/service/test_stack_adopt.py
+++ b/heat/tests/engine/service/test_stack_adopt.py
@@ -55,7 +55,7 @@ class StackServiceAdoptTest(common.HeatTestCase):
         return template, adopt_data
 
     def test_stack_adopt_with_params(self):
-        cfg.CONF.set_override('enable_stack_adopt', True)
+        cfg.CONF.set_override('enable_stack_adopt', True, enforce_type=True)
         env = {'parameters': {"app_dbx": "test"}}
         template, adopt_data = self._get_adopt_data_and_template(env)
         result = self.man.create_stack(self.ctx, "test_adopt_with_params",
@@ -68,7 +68,7 @@ class StackServiceAdoptTest(common.HeatTestCase):
                          stack.raw_template.environment['parameters'])
 
     def test_stack_adopt_saves_input_params(self):
-        cfg.CONF.set_override('enable_stack_adopt', True)
+        cfg.CONF.set_override('enable_stack_adopt', True, enforce_type=True)
         env = {'parameters': {"app_dbx": "foo"}}
         input_params = {
             "parameters": {"app_dbx": "bar"}
@@ -84,7 +84,7 @@ class StackServiceAdoptTest(common.HeatTestCase):
                          stack.raw_template.environment['parameters'])
 
     def test_stack_adopt_stack_state(self):
-        cfg.CONF.set_override('enable_stack_adopt', True)
+        cfg.CONF.set_override('enable_stack_adopt', True, enforce_type=True)
         env = {'parameters': {"app_dbx": "test"}}
         template, adopt_data = self._get_adopt_data_and_template(env)
         result = self.man.create_stack(self.ctx, "test_adopt_stack_state",
@@ -97,7 +97,7 @@ class StackServiceAdoptTest(common.HeatTestCase):
 
     def test_stack_adopt_disabled(self):
         # to test disable stack adopt
-        cfg.CONF.set_override('enable_stack_adopt', False)
+        cfg.CONF.set_override('enable_stack_adopt', False, enforce_type=True)
         env = {'parameters': {"app_dbx": "test"}}
         template, adopt_data = self._get_adopt_data_and_template(env)
         ex = self.assertRaises(
diff --git a/heat/tests/engine/service/test_stack_create.py b/heat/tests/engine/service/test_stack_create.py
index 4390dd8d01..6fe9720eb2 100644
--- a/heat/tests/engine/service/test_stack_create.py
+++ b/heat/tests/engine/service/test_stack_create.py
@@ -86,12 +86,12 @@ class StackCreateTest(common.HeatTestCase):
                                 environment_files=environment_files)
 
     def test_stack_create_equals_max_per_tenant(self):
-        cfg.CONF.set_override('max_stacks_per_tenant', 1)
+        cfg.CONF.set_override('max_stacks_per_tenant', 1, enforce_type=True)
         stack_name = 'service_create_test_stack_equals_max'
         self._test_stack_create(stack_name)
 
     def test_stack_create_exceeds_max_per_tenant(self):
-        cfg.CONF.set_override('max_stacks_per_tenant', 0)
+        cfg.CONF.set_override('max_stacks_per_tenant', 0, enforce_type=True)
         stack_name = 'service_create_test_stack_exceeds_max'
         ex = self.assertRaises(dispatcher.ExpectedException,
                                self._test_stack_create, stack_name)
@@ -240,7 +240,7 @@ class StackCreateTest(common.HeatTestCase):
                                     return_value=stk.env)
         mock_stack = self.patchobject(stack, 'Stack', return_value=stk)
 
-        cfg.CONF.set_override('max_resources_per_stack', 3)
+        cfg.CONF.set_override('max_resources_per_stack', 3, enforce_type=True)
 
         result = self.man.create_stack(self.ctx, stack_name, template, params,
                                        None, {})
@@ -272,7 +272,7 @@ class StackCreateTest(common.HeatTestCase):
             }
         }
 
-        cfg.CONF.set_override('max_resources_per_stack', 2)
+        cfg.CONF.set_override('max_resources_per_stack', 2, enforce_type=True)
         ex = self.assertRaises(dispatcher.ExpectedException,
                                self.man.create_stack, self.ctx, stack_name,
                                tpl, params, None, {})
@@ -354,6 +354,6 @@ class StackCreateTest(common.HeatTestCase):
     def test_stack_create_max_unlimited(self, total_res_mock, validate_mock):
         total_res_mock.return_value = 9999
         validate_mock.return_value = None
-        cfg.CONF.set_override('max_resources_per_stack', -1)
+        cfg.CONF.set_override('max_resources_per_stack', -1, enforce_type=True)
         stack_name = 'service_create_test_max_unlimited'
         self._test_stack_create(stack_name)
diff --git a/heat/tests/engine/service/test_stack_update.py b/heat/tests/engine/service/test_stack_update.py
index 766192eb88..7c0d53c0b4 100644
--- a/heat/tests/engine/service/test_stack_update.py
+++ b/heat/tests/engine/service/test_stack_update.py
@@ -444,7 +444,7 @@ class ServiceStackUpdateTest(common.HeatTestCase):
         mock_validate = self.patchobject(stk, 'validate', return_value=None)
 
         # do update
-        cfg.CONF.set_override('max_resources_per_stack', 3)
+        cfg.CONF.set_override('max_resources_per_stack', 3, enforce_type=True)
 
         api_args = {'timeout_mins': 60}
         result = self.man.update_stack(self.ctx, old_stack.identifier(),
@@ -532,7 +532,7 @@ class ServiceStackUpdateTest(common.HeatTestCase):
         sid = old_stack.store()
         self.assertIsNotNone(sid)
 
-        cfg.CONF.set_override('max_resources_per_stack', 2)
+        cfg.CONF.set_override('max_resources_per_stack', 2, enforce_type=True)
 
         ex = self.assertRaises(dispatcher.ExpectedException,
                                self.man.update_stack, self.ctx,
diff --git a/heat/tests/openstack/cinder/test_volume.py b/heat/tests/openstack/cinder/test_volume.py
index 0435c1df96..4f6a27ea2f 100644
--- a/heat/tests/openstack/cinder/test_volume.py
+++ b/heat/tests/openstack/cinder/test_volume.py
@@ -997,7 +997,8 @@ class CinderVolumeTest(vt_base.BaseVolumeTest):
 
     def test_cinder_create_with_stack_scheduler_hints(self):
         fv = vt_base.FakeVolume('creating')
-        sh.cfg.CONF.set_override('stack_scheduler_hints', True)
+        sh.cfg.CONF.set_override('stack_scheduler_hints', True,
+                                 enforce_type=True)
 
         stack_name = 'test_cvolume_stack_scheduler_hints_stack'
         t = template_format.parse(single_cinder_volume_template)
diff --git a/heat/tests/openstack/heat/test_remote_stack.py b/heat/tests/openstack/heat/test_remote_stack.py
index ef379f6e04..5d6c672d0b 100644
--- a/heat/tests/openstack/heat/test_remote_stack.py
+++ b/heat/tests/openstack/heat/test_remote_stack.py
@@ -130,7 +130,7 @@ class RemoteStackTest(tests_common.HeatTestCase):
         self.that_region = 'RegionTwo'
         self.bad_region = 'RegionNone'
 
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         self.parent = None
         self.heat = None
         self.client_plugin = None
diff --git a/heat/tests/openstack/magnum/test_bay.py b/heat/tests/openstack/magnum/test_bay.py
index d25efd3e1b..86258ff54b 100644
--- a/heat/tests/openstack/magnum/test_bay.py
+++ b/heat/tests/openstack/magnum/test_bay.py
@@ -75,7 +75,7 @@ class TestMagnumBay(common.HeatTestCase):
         self.assertEqual((b.CREATE, b.COMPLETE), b.state)
 
     def test_bay_create_failed(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         b = self._create_resource('bay', self.rsrc_defn, self.stack,
                                   stat='CREATE_FAILED')
         exc = self.assertRaises(
diff --git a/heat/tests/openstack/neutron/test_neutron_loadbalancer.py b/heat/tests/openstack/neutron/test_neutron_loadbalancer.py
index e734986cf5..66385f1213 100644
--- a/heat/tests/openstack/neutron/test_neutron_loadbalancer.py
+++ b/heat/tests/openstack/neutron/test_neutron_loadbalancer.py
@@ -430,7 +430,7 @@ class PoolTest(common.HeatTestCase):
         self.m.VerifyAll()
 
     def test_create_failed_error_status(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
 
         snippet = template_format.parse(pool_template)
         self.stack = utils.parse_stack(snippet)
diff --git a/heat/tests/openstack/nova/test_server.py b/heat/tests/openstack/nova/test_server.py
index 2eaac09b5c..9db7f82670 100644
--- a/heat/tests/openstack/nova/test_server.py
+++ b/heat/tests/openstack/nova/test_server.py
@@ -899,7 +899,8 @@ class ServersTest(common.HeatTestCase):
                          return_value=self.fc)
         return_server = self.fc.servers.list()[1]
         return_server.id = '5678'
-        sh.cfg.CONF.set_override('stack_scheduler_hints', True)
+        sh.cfg.CONF.set_override('stack_scheduler_hints', True,
+                                 enforce_type=True)
         # Unroll _create_test_server, to enable check
         # for addition of heat ids (stack id, resource name)
         stack_name = 'test_server_w_stack_sched_hints_s'
diff --git a/heat/tests/openstack/sahara/test_cluster.py b/heat/tests/openstack/sahara/test_cluster.py
index 86042e6ca7..538bbd3dd7 100644
--- a/heat/tests/openstack/sahara/test_cluster.py
+++ b/heat/tests/openstack/sahara/test_cluster.py
@@ -111,7 +111,7 @@ class SaharaClusterTest(common.HeatTestCase):
         self.cl_mgr.get.assert_called_once_with(self.fake_cl.id)
 
     def test_cluster_create_fails(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         cluster = self._init_cluster(self.t)
         self.cl_mgr.create.return_value = self.fake_cl
         self.cl_mgr.get.return_value = FakeCluster(status='Error')
diff --git a/heat/tests/openstack/senlin/test_cluster.py b/heat/tests/openstack/senlin/test_cluster.py
index 51ffffd3cd..ff797c23b0 100644
--- a/heat/tests/openstack/senlin/test_cluster.py
+++ b/heat/tests/openstack/senlin/test_cluster.py
@@ -117,7 +117,7 @@ class SenlinClusterTest(common.HeatTestCase):
         self.senlin_mock.get_cluster.assert_called_once_with(self.fake_cl.id)
 
     def test_cluster_create_error(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         cluster = self._init_cluster(self.t)
         self.senlin_mock.create_cluster.return_value = self.fake_cl
         self.senlin_mock.get_cluster.return_value = FakeCluster(
diff --git a/heat/tests/openstack/senlin/test_node.py b/heat/tests/openstack/senlin/test_node.py
index c95a4f556a..3007aa0ad2 100644
--- a/heat/tests/openstack/senlin/test_node.py
+++ b/heat/tests/openstack/senlin/test_node.py
@@ -102,7 +102,7 @@ class SenlinNodeTest(common.HeatTestCase):
         self.senlin_mock.get_node.assert_called_once_with(self.fake_node.id)
 
     def test_node_create_error(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         self.senlin_mock.create_node.return_value = self.fake_node
         self.senlin_mock.get_node.return_value = FakeNode(
             status='ERROR')
diff --git a/heat/tests/openstack/senlin/test_policy.py b/heat/tests/openstack/senlin/test_policy.py
index cc49daa1ce..139105be51 100644
--- a/heat/tests/openstack/senlin/test_policy.py
+++ b/heat/tests/openstack/senlin/test_policy.py
@@ -108,7 +108,7 @@ class SenlinPolicyTest(common.HeatTestCase):
             **expect_kwargs)
 
     def test_policy_create_fail(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         policy = self._init_policy(self.t)
         self.senlin_mock.create_policy.return_value = self.fake_p
         self.senlin_mock.cluster_attach_policy.return_value = {
diff --git a/heat/tests/test_common_context.py b/heat/tests/test_common_context.py
index 75a50e421a..c432d6dbdf 100644
--- a/heat/tests/test_common_context.py
+++ b/heat/tests/test_common_context.py
@@ -123,7 +123,7 @@ class TestRequestContext(common.HeatTestCase):
     def test_keystone_v3_endpoint_in_context(self):
         """Ensure that the context is the preferred source for the auth_uri."""
         cfg.CONF.set_override('auth_uri', 'http://xyz',
-                              group='clients_keystone')
+                              group='clients_keystone', enforce_type=True)
         policy_check = 'heat.common.policy.Enforcer.check_is_admin'
         with mock.patch(policy_check) as pc:
             pc.return_value = False
@@ -139,10 +139,10 @@ class TestRequestContext(common.HeatTestCase):
         the preferred source when the context does not have the auth_uri.
         """
         cfg.CONF.set_override('auth_uri', 'http://xyz',
-                              group='clients_keystone')
+                              group='clients_keystone', enforce_type=True)
         importutils.import_module('keystonemiddleware.auth_token')
         cfg.CONF.set_override('auth_uri', 'http://abc/v2.0',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         policy_check = 'heat.common.policy.Enforcer.check_is_admin'
         with mock.patch(policy_check) as pc:
             pc.return_value = False
@@ -164,7 +164,7 @@ class TestRequestContext(common.HeatTestCase):
         """
         importutils.import_module('keystonemiddleware.auth_token')
         cfg.CONF.set_override('auth_uri', 'http://abc/v2.0',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         policy_check = 'heat.common.policy.Enforcer.check_is_admin'
         with mock.patch(policy_check) as pc:
             pc.return_value = False
@@ -187,11 +187,11 @@ class TestRequestContext(common.HeatTestCase):
     def test_create_trusts_auth_plugin_with_correct_user_domain_id(self):
         importutils.import_module('keystonemiddleware.auth_token')
         cfg.CONF.set_override('auth_uri', 'http://abc/v2.0',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         cfg.CONF.set_override('admin_user', 'heat',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         cfg.CONF.set_override('admin_password', 'password',
-                              group='keystone_authtoken')
+                              group='keystone_authtoken', enforce_type=True)
         policy_check = 'heat.common.policy.Enforcer.check_is_admin'
         with mock.patch(policy_check) as pc:
             pc.return_value = False
diff --git a/heat/tests/test_convg_stack.py b/heat/tests/test_convg_stack.py
index 0a29113484..6c2c49a123 100644
--- a/heat/tests/test_convg_stack.py
+++ b/heat/tests/test_convg_stack.py
@@ -33,7 +33,7 @@ from heat.tests import utils
 class StackConvergenceCreateUpdateDeleteTest(common.HeatTestCase):
     def setUp(self):
         super(StackConvergenceCreateUpdateDeleteTest, self).setUp()
-        cfg.CONF.set_override('convergence_engine', True)
+        cfg.CONF.set_override('convergence_engine', True, enforce_type=True)
         self.stack = None
 
     @mock.patch.object(parser.Stack, 'mark_complete')
@@ -530,7 +530,7 @@ class StackConvergenceCreateUpdateDeleteTest(common.HeatTestCase):
 class TestConvgStackStateSet(common.HeatTestCase):
     def setUp(self):
         super(TestConvgStackStateSet, self).setUp()
-        cfg.CONF.set_override('convergence_engine', True)
+        cfg.CONF.set_override('convergence_engine', True, enforce_type=True)
         self.stack = tools.get_stack(
             'test_stack', utils.dummy_context(),
             template=tools.wp_template, convergence=True)
diff --git a/heat/tests/test_crypt.py b/heat/tests/test_crypt.py
index 22de431ab5..98542b6837 100644
--- a/heat/tests/test_crypt.py
+++ b/heat/tests/test_crypt.py
@@ -30,7 +30,8 @@ class CryptTest(common.HeatTestCase):
 
     def test_init_auth_encryption_key_length(self):
         """Test for length of the auth_encryption_length in config file"""
-        cfg.CONF.set_override('auth_encryption_key', 'abcdefghijklma')
+        cfg.CONF.set_override('auth_encryption_key', 'abcdefghijklma',
+                              enforce_type=True)
         err = self.assertRaises(exception.Error,
                                 config.startup_sanity_check)
         exp_msg = ('heat.conf misconfigured, auth_encryption_key '
diff --git a/heat/tests/test_engine_service.py b/heat/tests/test_engine_service.py
index a2a266973b..a7cada7dbd 100644
--- a/heat/tests/test_engine_service.py
+++ b/heat/tests/test_engine_service.py
@@ -209,7 +209,7 @@ class StackConvergenceServiceCreateUpdateTest(common.HeatTestCase):
 
     def setUp(self):
         super(StackConvergenceServiceCreateUpdateTest, self).setUp()
-        cfg.CONF.set_override('convergence_engine', True)
+        cfg.CONF.set_override('convergence_engine', True, enforce_type=True)
         self.ctx = utils.dummy_context()
         self.man = service.EngineService('a-host', 'a-topic')
 
@@ -829,7 +829,7 @@ class StackServiceTest(common.HeatTestCase):
 
     @tools.stack_context('service_export_stack')
     def test_export_stack(self):
-        cfg.CONF.set_override('enable_stack_abandon', True)
+        cfg.CONF.set_override('enable_stack_abandon', True, enforce_type=True)
         self.m.StubOutWithMock(parser.Stack, 'load')
         parser.Stack.load(self.ctx,
                           stack=mox.IgnoreArg()).AndReturn(self.stack)
@@ -862,7 +862,7 @@ class StackServiceTest(common.HeatTestCase):
 
     @tools.stack_context('service_abandon_stack')
     def test_abandon_stack(self):
-        cfg.CONF.set_override('enable_stack_abandon', True)
+        cfg.CONF.set_override('enable_stack_abandon', True, enforce_type=True)
         self.m.StubOutWithMock(parser.Stack, 'load')
         parser.Stack.load(self.ctx,
                           stack=mox.IgnoreArg()).AndReturn(self.stack)
@@ -1203,7 +1203,7 @@ class StackServiceTest(common.HeatTestCase):
 
     @mock.patch.object(stack_object.Stack, 'count_all')
     def test_validate_new_stack_checks_stack_limit(self, mock_db_count):
-        cfg.CONF.set_override('max_stacks_per_tenant', 99)
+        cfg.CONF.set_override('max_stacks_per_tenant', 99, enforce_type=True)
         mock_db_count.return_value = 99
         template = templatem.Template(
             {'HeatTemplateFormatVersion': '2012-12-12'})
@@ -1238,7 +1238,7 @@ class StackServiceTest(common.HeatTestCase):
         self.assertEqual(msg, six.text_type(ex))
 
     def test_validate_new_stack_checks_resource_limit(self):
-        cfg.CONF.set_override('max_resources_per_stack', 5)
+        cfg.CONF.set_override('max_resources_per_stack', 5, enforce_type=True)
         template = {'HeatTemplateFormatVersion': '2012-12-12',
                     'Resources': {
                         'Res1': {'Type': 'GenericResource1'},
@@ -1385,7 +1385,7 @@ class StackServiceTest(common.HeatTestCase):
         self.assertEqual('FAILED', test_stack.resources.get('r3').status)
 
     def test_parse_adopt_stack_data_without_parameters(self):
-        cfg.CONF.set_override('enable_stack_adopt', True)
+        cfg.CONF.set_override('enable_stack_adopt', True, enforce_type=True)
         template = {"heat_template_version": "2015-04-30",
                     "resources": {
                         "myres": {
@@ -1410,7 +1410,7 @@ class StackServiceTest(common.HeatTestCase):
             self.ctx, 'stack_name', template, {}, {}, None, args)
 
     def test_parse_adopt_stack_data_with_parameters(self):
-        cfg.CONF.set_override('enable_stack_adopt', True)
+        cfg.CONF.set_override('enable_stack_adopt', True, enforce_type=True)
         template = {"heat_template_version": "2015-04-30",
                     "parameters": {
                         "volsize": {"type": "number"}
diff --git a/heat/tests/test_environment.py b/heat/tests/test_environment.py
index 8e72767cd3..94896faff3 100644
--- a/heat/tests/test_environment.py
+++ b/heat/tests/test_environment.py
@@ -181,7 +181,8 @@ def constraint_mapping():
         with open(plugin_file, 'w+') as ef:
             ef.write(constraint_content)
         self.addCleanup(sys.modules.pop, "heat.engine.plugins.test")
-        cfg.CONF.set_override('plugin_dirs', plugin_dir.path)
+        cfg.CONF.set_override('plugin_dirs', plugin_dir.path,
+                              enforce_type=True)
 
         env = environment.Environment({})
         resources._load_global_environment(env)
@@ -200,7 +201,8 @@ def constraint_mapping():
         with open(plugin_file, 'w+') as ef:
             ef.write(constraint_content)
         self.addCleanup(sys.modules.pop, "heat.engine.plugins.test")
-        cfg.CONF.set_override('plugin_dirs', plugin_dir.path)
+        cfg.CONF.set_override('plugin_dirs', plugin_dir.path,
+                              enforce_type=True)
 
         env = environment.Environment({})
         error = self.assertRaises(ValueError,
@@ -393,7 +395,8 @@ class GlobalEnvLoadingTest(common.HeatTestCase):
         envfile = os.path.join(envdir.path, 'test.yaml')
         with open(envfile, 'w+') as ef:
             ef.write(g_env_content)
-        cfg.CONF.set_override('environment_dir', envdir.path)
+        cfg.CONF.set_override('environment_dir', envdir.path,
+                              enforce_type=True)
 
         # 2. load global env
         g_env = environment.Environment({}, user_env=False)
@@ -415,7 +418,8 @@ class GlobalEnvLoadingTest(common.HeatTestCase):
         envfile = os.path.join(envdir.path, 'test.yaml')
         with open(envfile, 'w+') as ef:
             ef.write(g_env_content)
-        cfg.CONF.set_override('environment_dir', envdir.path)
+        cfg.CONF.set_override('environment_dir', envdir.path,
+                              enforce_type=True)
 
         # 2. load global env
         g_env = environment.Environment({}, user_env=False)
@@ -441,7 +445,8 @@ class GlobalEnvLoadingTest(common.HeatTestCase):
         envfile = os.path.join(envdir.path, 'test.yaml')
         with open(envfile, 'w+') as ef:
             ef.write(g_env_content)
-        cfg.CONF.set_override('environment_dir', envdir.path)
+        cfg.CONF.set_override('environment_dir', envdir.path,
+                              enforce_type=True)
 
         # 2. load global env
         g_env = environment.Environment({}, user_env=False)
@@ -483,7 +488,8 @@ class GlobalEnvLoadingTest(common.HeatTestCase):
             ef.write(g_env_content)
         with open(os.path.join(envdir.path, 'b.yaml'), 'w+') as ef:
             ef.write(g_env_content)
-        cfg.CONF.set_override('environment_dir', envdir.path)
+        cfg.CONF.set_override('environment_dir', envdir.path,
+                              enforce_type=True)
 
         # 2. load global env
         g_env = environment.Environment({}, user_env=False)
diff --git a/heat/tests/test_event.py b/heat/tests/test_event.py
index 432249f2b8..af9bef2319 100644
--- a/heat/tests/test_event.py
+++ b/heat/tests/test_event.py
@@ -172,8 +172,8 @@ class EventTest(EventCommon):
         self.assertEqual({'Foo': 'goo'}, loaded_e.resource_properties)
 
     def test_store_caps_events(self):
-        cfg.CONF.set_override('event_purge_batch_size', 1)
-        cfg.CONF.set_override('max_events_per_stack', 1)
+        cfg.CONF.set_override('event_purge_batch_size', 1, enforce_type=True)
+        cfg.CONF.set_override('max_events_per_stack', 1, enforce_type=True)
         self.resource.resource_id_set('resource_physical_id')
 
         e = event.Event(self.ctx, self.stack, 'TEST', 'IN_PROGRESS', 'Testing',
diff --git a/heat/tests/test_fault_middleware.py b/heat/tests/test_fault_middleware.py
index 01efb17e9e..d2d6a887c7 100644
--- a/heat/tests/test_fault_middleware.py
+++ b/heat/tests/test_fault_middleware.py
@@ -95,7 +95,7 @@ class FaultMiddlewareTest(common.HeatTestCase):
 
     def test_exception_with_non_ascii_chars(self):
         # We set debug to true to test the code path for serializing traces too
-        cfg.CONF.set_override('debug', True)
+        cfg.CONF.set_override('debug', True, enforce_type=True)
         msg = u'Error with non-ascii chars \x80'
 
         class TestException(heat_exc.HeatException):
@@ -115,7 +115,7 @@ class FaultMiddlewareTest(common.HeatTestCase):
 
     def test_remote_exception(self):
         # We want tracebacks
-        cfg.CONF.set_override('debug', True)
+        cfg.CONF.set_override('debug', True, enforce_type=True)
         error = heat_exc.EntityNotFound(entity='Stack', name='a')
         exc_info = (type(error), error, None)
         serialized = rpc_common.serialize_remote_exception(exc_info)
@@ -222,7 +222,7 @@ class FaultMiddlewareTest(common.HeatTestCase):
 
     def test_should_not_ignore_parent_classes_even_for_remote_ones(self):
         # We want tracebacks
-        cfg.CONF.set_override('debug', True)
+        cfg.CONF.set_override('debug', True, enforce_type=True)
 
         error = StackNotFoundChild(entity='Stack', name='a')
         exc_info = (type(error), error, None)
diff --git a/heat/tests/test_resource.py b/heat/tests/test_resource.py
index 586021e20d..f75f4d31db 100644
--- a/heat/tests/test_resource.py
+++ b/heat/tests/test_resource.py
@@ -440,7 +440,7 @@ class ResourceTest(common.HeatTestCase):
         res, utmpl = self._setup_resource_for_update(
             res_name='test_update_rsrc_in_progress_raises_exception')
 
-        cfg.CONF.set_override('convergence_engine', False)
+        cfg.CONF.set_override('convergence_engine', False, enforce_type=True)
 
         res.action = res.UPDATE
         res.status = res.IN_PROGRESS
@@ -795,7 +795,7 @@ class ResourceTest(common.HeatTestCase):
         self.m.VerifyAll()
 
     def test_create_fail_retry_disabled(self):
-        cfg.CONF.set_override('action_retry_limit', 0)
+        cfg.CONF.set_override('action_retry_limit', 0, enforce_type=True)
         tmpl = rsrc_defn.ResourceDefinition('test_resource', 'Foo',
                                             {'Foo': 'abc'})
         res = generic_rsrc.ResourceWithProps('test_resource', tmpl, self.stack)
@@ -1597,7 +1597,8 @@ class ResourceTest(common.HeatTestCase):
         self.assertEqual({'foo': 'res', 'Foo': 'res'}, res.FnGetAtts())
 
     def test_properties_data_stored_encrypted_decrypted_on_load(self):
-        cfg.CONF.set_override('encrypt_parameters_and_properties', True)
+        cfg.CONF.set_override('encrypt_parameters_and_properties', True,
+                              enforce_type=True)
 
         tmpl = rsrc_defn.ResourceDefinition('test_resource', 'Foo')
         stored_properties_data = {'prop1': 'string',
@@ -1641,7 +1642,8 @@ class ResourceTest(common.HeatTestCase):
         self.assertEqual('string', res_obj.properties_data['prop1'])
 
     def test_properties_data_no_encryption(self):
-        cfg.CONF.set_override('encrypt_parameters_and_properties', False)
+        cfg.CONF.set_override('encrypt_parameters_and_properties', False,
+                              enforce_type=True)
 
         tmpl = rsrc_defn.ResourceDefinition('test_resource', 'Foo')
         stored_properties_data = {'prop1': 'string',
@@ -3571,7 +3573,7 @@ class TestLiveStateUpdate(common.HeatTestCase):
         res = self._prepare_resource_live_state()
         res.resource_id = self.resource_id
 
-        cfg.CONF.set_override('observe_on_update', True)
+        cfg.CONF.set_override('observe_on_update', True, enforce_type=True)
 
         utmpl = rsrc_defn.ResourceDefinition('test_resource',
                                              'ResourceWithPropsType',
diff --git a/heat/tests/test_stack.py b/heat/tests/test_stack.py
index 7ef8295e59..5c5481a231 100644
--- a/heat/tests/test_stack.py
+++ b/heat/tests/test_stack.py
@@ -94,7 +94,8 @@ class StackTest(common.HeatTestCase):
         self.assertEqual('', self.stack.status_reason)
 
     def test_timeout_secs_default(self):
-        cfg.CONF.set_override('stack_action_timeout', 1000)
+        cfg.CONF.set_override('stack_action_timeout', 1000,
+                              enforce_type=True)
         self.stack = stack.Stack(self.ctx, 'test_stack', self.tmpl)
         self.assertIsNone(self.stack.timeout_mins)
         self.assertEqual(1000, self.stack.timeout_secs())
@@ -1332,7 +1333,8 @@ class StackTest(common.HeatTestCase):
 
     def test_store_saves_creds_trust(self):
         """A user_creds entry is created on first stack store."""
-        cfg.CONF.set_override('deferred_auth_method', 'trusts')
+        cfg.CONF.set_override('deferred_auth_method', 'trusts',
+                              enforce_type=True)
 
         self.m.StubOutWithMock(keystone.KeystoneClientPlugin, '_create')
         keystone.KeystoneClientPlugin._create().AndReturn(
@@ -2294,7 +2296,8 @@ class StackTest(common.HeatTestCase):
         env1 = environment.Environment({'param1': 'foo', 'param2': 'bar'})
         self.stack = stack.Stack(self.ctx, 'test',
                                  template.Template(tmpl, env=env1))
-        cfg.CONF.set_override('encrypt_parameters_and_properties', False)
+        cfg.CONF.set_override('encrypt_parameters_and_properties', False,
+                              enforce_type=True)
 
         # Verify that hidden parameters stored in plain text
         self.stack.store()
@@ -2322,7 +2325,8 @@ class StackTest(common.HeatTestCase):
         env1 = environment.Environment({'param1': 'foo', 'param2': 'bar'})
         self.stack = stack.Stack(self.ctx, 'test',
                                  template.Template(tmpl, env=env1))
-        cfg.CONF.set_override('encrypt_parameters_and_properties', True)
+        cfg.CONF.set_override('encrypt_parameters_and_properties', True,
+                              enforce_type=True)
 
         # Verify that hidden parameters are stored encrypted
         self.stack.store()
@@ -2378,7 +2382,8 @@ class StackTest(common.HeatTestCase):
         env1 = environment.Environment({'param1': 'foo', 'param2': 'bar'})
         self.stack = stack.Stack(self.ctx, 'test',
                                  template.Template(tmpl, env=env1))
-        cfg.CONF.set_override('encrypt_parameters_and_properties', False)
+        cfg.CONF.set_override('encrypt_parameters_and_properties', False,
+                              enforce_type=True)
 
         # Verify that hidden parameters are stored decrypted
         self.stack.store()
diff --git a/heat/tests/test_stack_resource.py b/heat/tests/test_stack_resource.py
index 4f7920f16f..702287c007 100644
--- a/heat/tests/test_stack_resource.py
+++ b/heat/tests/test_stack_resource.py
@@ -455,7 +455,8 @@ class StackResourceTest(StackResourceBaseTest):
         self.assertEqual(4, rsrc.FnGetAtt(rsrc.CURRENT_SIZE))
 
     def test__validate_nested_resources_checks_num_of_resources(self):
-        stack_resource.cfg.CONF.set_override('max_resources_per_stack', 2)
+        stack_resource.cfg.CONF.set_override('max_resources_per_stack', 2,
+                                             enforce_type=True)
         tmpl = {'HeatTemplateFormatVersion': '2012-12-12',
                 'Resources': [1]}
         template = stack_resource.template.Template(tmpl)
diff --git a/heat/tests/test_template_format.py b/heat/tests/test_template_format.py
index cfc42a7799..2838dbb6f0 100644
--- a/heat/tests/test_template_format.py
+++ b/heat/tests/test_template_format.py
@@ -97,7 +97,8 @@ class YamlMinimalTest(common.HeatTestCase):
 
     def test_long_yaml(self):
         template = {'HeatTemplateFormatVersion': '2012-12-12'}
-        config.cfg.CONF.set_override('max_template_size', 10)
+        config.cfg.CONF.set_override('max_template_size', 10,
+                                     enforce_type=True)
         template['Resources'] = ['a'] * int(
             config.cfg.CONF.max_template_size / 3)
         limit = config.cfg.CONF.max_template_size
diff --git a/heat/tests/test_urlfetch.py b/heat/tests/test_urlfetch.py
index 8ae88d1051..b2d4e56aa2 100644
--- a/heat/tests/test_urlfetch.py
+++ b/heat/tests/test_urlfetch.py
@@ -113,7 +113,7 @@ class UrlFetchTest(common.HeatTestCase):
         url = 'http://example.com/template'
         data = b'{ "foo": "bar" }'
         response = Response(data)
-        cfg.CONF.set_override('max_template_size', 500)
+        cfg.CONF.set_override('max_template_size', 500, enforce_type=True)
         requests.get(url, stream=True).AndReturn(response)
         self.m.ReplayAll()
         urlfetch.get(url)
@@ -123,7 +123,7 @@ class UrlFetchTest(common.HeatTestCase):
         url = 'http://example.com/template'
         data = b'{ "foo": "bar" }'
         response = Response(data)
-        cfg.CONF.set_override('max_template_size', 5)
+        cfg.CONF.set_override('max_template_size', 5, enforce_type=True)
         requests.get(url, stream=True).AndReturn(response)
         self.m.ReplayAll()
         exception = self.assertRaises(urlfetch.URLFetchError,