Nested quota is a change in how OpenStack services (such as Block Storage and Compute) handle their quota resources by being hierarchy-aware. The main reason for this change is to fully appreciate the hierarchical multi-tenancy concept, which was introduced in keystone in the Kilo release.
Once you have a project hierarchy created in keystone, nested quotas let you define how much of a project’s quota you want to give to its subprojects. In that way, hierarchical projects can have hierarchical quotas (also known as nested quotas).
Projects and subprojects have similar behaviors, but they differ from each other when it comes to default quota values. The default quota value for resources in a subproject is 0, so that when a subproject is created it will not consume all of its parent’s quota.
In order to keep track of how much of each quota was allocated to a
subproject, a column allocated
was added to the quotas table. This column
is updated after every delete and update quota operation.
This example shows you how to use nested quotas.
Note
Assume that you have created a project hierarchy in keystone, such as follows:
+-----------+
| |
| A |
| / \ |
| B C |
| / |
| D |
+-----------+
Get the quota for root projects.
Use the openstack quota show command and specify:
The PROJECT
of the relevant project. In this case, the name of
project A.
$ openstack quota show PROJECT
+----------------------+-------+
| Field | Value |
+----------------------+-------+
| ... | ... |
| backup_gigabytes | 1000 |
| backups | 10 |
| gigabytes | 1000 |
| per_volume_gigabytes | -1 |
| snapshots | 10 |
| volumes | 10 |
+----------------------+-------+
Note
This command returns the default values for resources. This is because the quotas for this project were not explicitly set.
Get the quota for subprojects.
In this case, use the same openstack quota show command and specify:
The PROJECT
of the relevant project. In this case the name of
project B, which is a child of A.
$ openstack quota show PROJECT
+----------------------+-------+
| Field | Value |
+----------------------+-------+
| ... | ... |
| backup_gigabytes | 0 |
| backups | 0 |
| gigabytes | 0 |
| per_volume_gigabytes | 0 |
| snapshots | 0 |
| volumes | 0 |
+----------------------+-------+
Note
In this case, 0 was the value returned as the quota for all the resources. This is because project B is a subproject of A, thus, the default quota value is 0, so that it will not consume all the quota of its parent project.
Now that the projects were created, assume that the admin of project B wants to use it. First of all, you need to set the quota limit of the project, because as a subproject it does not have quotas allocated by default.
In this example, when all of the parent project is allocated to its subprojects the user will not be able to create more resources in the parent project.
Update the quota of B.
Use the openstack quota set command and specify:
The PROJECT
of the relevant project.
In this case the name of project B.
The --volumes
option, followed by the number to which you wish to
increase the volumes quota.
$ openstack quota set --volumes 10 PROJECT
+----------------------+-------+
| Property | Value |
+----------------------+-------+
| ... | ... |
| backup_gigabytes | 0 |
| backups | 0 |
| gigabytes | 0 |
| per_volume_gigabytes | 0 |
| snapshots | 0 |
| volumes | 10 |
+----------------------+-------+
Note
The volumes resource quota is updated.
Try to create a volume in project A.
Use the openstack volume create command and specify:
The SIZE
of the volume that will be created;
The NAME
of the volume.
$ openstack volume create --size SIZE NAME
VolumeLimitExceeded: Maximum number of volumes allowed (10) exceeded for quota 'volumes'. (HTTP 413) (Request-ID: req-f6f7cc89-998e-4a82-803d-c73c8ee2016c)
Note
As the entirety of project A’s volumes quota has been assigned to project B, it is treated as if all of the quota has been used. This is true even when project B has not created any volumes.
See cinder nested quota spec and hierarchical multi-tenancy spec for details.
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.