OpenStack Compute (nova)

Smaller project quota value than user quota value can be set

Bug #1841128 reported by Mitsuhiro Tanino
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
In Progress
Undecided
Mitsuhiro Tanino

Bug Description

Description
===========
Smaller project quota than user quota value can be set
This problems only happens when project quota value is unlimited with DbQuotaDriver driver.
In the quota calculation steps, _process_quotas() and get_settable_quotas() are called to calculate modification of quota. In these methods, "ramains" which indicates available amount of resource for user is set to wrong value when the project quota value is unlimited. As a result, this problem happens.

Steps to reproduce
==================
$ openstack user create test --domain default --password password
…
| id | a22c08f37f34447d81f597144b2b8831 |
…
$ openstack project create test-project --domain default --property=user_id=$(openstack user show test -f value -c id)
…
| id | c9a3b873f10947fea01c833e25884b3e |
…
$ openstack role add --user test --project test-project member

(a) Confirm instances of project and user quota. Initial values are both of 10.
$ nova quota-show --tenant c9a3b873f10947fea01c833e25884b3e | grep instances
| instances | 10 |
$ nova quota-show --user a22c08f37f34447d81f597144b2b8831 --tenant c9a3b873f10947fea01c833e25884b3e | grep instances
| instances | 10 |

(b) Update project quota to unlimited
$ nova quota-update --instances -1 c9a3b873f10947fea01c833e25884b3e; nova quota-show --tenant c9a3b873f10947fea01c833e25884b3e | grep instances
| instances | -1 |
(c) Update user quota to 20.
$ nova quota-update --user a22c08f37f34447d81f597144b2b8831 --instances 20 c9a3b873f10947fea01c833e25884b3e; nova quota-show --user a22c08f37f34447d81f597144b2b8831 --tenant c9a3b873f10947fea01c833e25884b3e | grep instances
| instances | 20 |

(d) Update project quota to 10 which is smaller than user quota.
$ nova quota-update --instances 10 c9a3b873f10947fea01c833e25884b3e; nova quota-show --tenant c9a3b873f10947fea01c833e25884b3e | grep instances
| instances | 10 |

Normally, project quota(=10) can not be set smaller value than user quota(=20), however this update can be succeeded when previous project quota value is unlimited.

Expected result
===============
Failed to update project quota value when the value is smaller than user's one.

Actual result
=============
Quota update was succeeded even though the project value is smaller than user's one.

Environment
===========
1. Exact version of OpenStack you are running. See the following
Devstack environment with latest master branch
$ git log -1
commit 0c861c29c12c2092c95ac45988ce2793e4aea20f
Merge: 170fd5a 791fa59
Author: Zuul <email address hidden>
Date: Thu Aug 22 23:49:25 2019 +0000

    Merge "Handle websockify v0.9.0 in console proxy"

2. Which hypervisor did you use?
  KVM, cent OS7.6
 $uname -a
 Linux devstack 3.10.0-957.27.2.el7.x86_64 #1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Tags: quotas
Mitsuhiro Tanino (mitsuhiro-tanino)
summary: - Smaller project quota than user quota value can be set
+ Smaller project quota value than user quota value can be set
Mitsuhiro Tanino (mitsuhiro-tanino)
Changed in nova:
assignee: nobody → Mitsuhiro Tanino (mitsuhiro-tanino)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.opendev.org/678183

Changed in nova:
status: New → In Progress
melanie witt (melwitt)
tags: added: quotas
Revision history for this message
Mitsuhiro Tanino (mitsuhiro-tanino) wrote :
Download full text (3.7 KiB)

Side effect of this bug is that once inconsistent quota configuration happens, user can exceed project quota(=20) even if user quota(=5) is smaller value. So the point is that once inconsistency happens both project and user quota doesn’t work properly.

❯❯❯ ./quota_show2.sh test1-project test1 test2
tenant_id=8da232c294f44ea186f9e1547bf87f71
user_id1=c828df4a8d01484a830b7c001fe70acb
user_id2=2fa464790ce24178b38e5735a4c0ca50
tenant
| instances | 10 |
 user1
| instances | 10 |
 user2
| instances | 10 |
 ❯❯❯ ./prj_inst_quota_update.sh test1-project -1
tenant_id=8da232c294f44ea186f9e1547bf87f71
Update project quota.
❯❯❯ ./usr_inst_quota_update.sh test1-project test2 5
tenant_id=8da232c294f44ea186f9e1547bf87f71
user_id=2fa464790ce24178b38e5735a4c0ca50
Update user quota.
❯❯❯ ./usr_inst_quota_update.sh test1-project test1 5
tenant_id=8da232c294f44ea186f9e1547bf87f71
user_id=c828df4a8d01484a830b7c001fe70acb
Update user quota.
❯❯❯ ./quota_show2.sh test1-project test1 test2
tenant_id=8da232c294f44ea186f9e1547bf87f71
user_id1=c828df4a8d01484a830b7c001fe70acb
user_id2=2fa464790ce24178b38e5735a4c0ca50
tenant
| instances | -1 |
 user1
| instances | 5 |
 user2
| instances | 5 |
  ~ ❯❯❯ ./prj_inst_quota_update.sh test1-project 2
tenant_id=8da232c294f44ea186f9e1547bstack001-upstream-jp2v-dev ~ ❯❯❯ ./quota_show2.sh test1-project test1 test2
tenant_id=8da232c294f44ea186f9e1547b001fe70acb
user_id2=2fa464790ce24178b38e5735a4c0ca50
tenant
| instances | 2 |
 user1
| instances | 5 |
 user2
| instances | 5 |
  ~ ❯❯❯ source openrc-test1
 ~ ❯❯❯ openstack server server create --image cirros_3.5 --flavor m1.tiny --nic net-id=$(openue) --min 5 --max 5 test
Quota exceeded for instances: Requested 5, but already used 0 of 2 instances (HTTP 403) (Request-ID: req-dc3ca7b3-3c55-459c-8c97-198c9692593a)
 ~ ❯❯❯ source openrc-admin
 ~ ❯❯❯ ./prj_inst_quota_update.sh test1-project 20
tenant_id=8da232c294f44ea186f9e1547
tenant_id=8da232c294f44ea186f9e1547b001fe70acb
user_id2=2fa464790ce24178b38e5735a4c0ca50
~ ❯❯❯ ./quota_show2.sh test1-project test1 test2
tenant
| instances | 20 |
 user1
| instances | 5 |
 user2
| instances | 5 |
  ~ ❯❯❯ source openrc-test1
 ~ ❯❯❯ openstack server create --image cirros_3.5 --flavor m1.tiny --nic net-id=$(openue) --min 5 --max 5 test 2>&1 > /dev/null
 ~ ❯❯❯ openstack server list -c ID -f value | wc
      5 5 185
 ~ ❯❯❯ openstack server create --image cirros_3.5 --flavor m1.tiny --nic net-id=$(openue) --min 5 --max 5 test 2>&1 > /dev/null
 ~ ❯❯❯ openstack server list -c ID -f value | wc
     10 10 370
 ~ ❯❯❯ openstack server create --image cirros_3.5 --flavor m1.tiny --nic net-id=$(openue) --min 5 --max 5 test 2>&1 > /dev/null
 ~ ❯❯❯ openstack server list -c ID -f value | wc
     15 15 555
 ~ ❯❯❯ openstack server create --image cirros_3.5 --flavor m1.tiny --nic net-id=$(openue) --min 5 --max 5 test 2>&1 > /dev/null
 ~ ❯❯❯ openstack server list -c ID -f value | wc
     20 20 740
 ~ ❯❯❯ openstack server create --image cirros_3.5 --flavor m1.tiny --nic n...

Read more...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.