Unable to assign more than 7 tenants to a filter_tenant_id string

Yup, this is a known limitation, and also that the AggregateMultiTenancyIsolation filter doesn't allow scoping to keystone domains. I think there is a Public Cloud SIG bug related to this as well.

The good news is once you get to Rocky, you can use the placement request filter to filter aggregates per tenant which supersedes the AggregateMultiTenancyIsolation filter:

https://docs.openstack.org/nova/latest/admin/configuration/schedulers.html#tenant-isolation-with-placement

The docs don't mention it (I don't think), but that placement request filter does allow namespacing the aggregate metadata so you can add as many tenants as you want:

https://github.com/openstack/nova/blob/e27905f482ba26d2bbf3ae5d948dee37523042d5/nova/scheduler/request_filter.py#L46

I'm just going to update the docs because we have a replacement for the old filter in Rocky.

The other workaround with the older AggregateMultiTenancyIsolation filter is to create as many aggregates for the same hosts as needed to cover the number of tenants needed. It's unfortunate but that's a workaround until you get to Rocky and can use the newer filtering mechanism.

Fix proposed to branch: master
Review: https://review.openstack.org/616991

Reviewed: https://review.openstack.org/616991
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=1fa09acf08dacf94a435fbdaddc50eabfada48ec
Submitter: Zuul
Branch: master

commit 1fa09acf08dacf94a435fbdaddc50eabfada48ec
Author: Matt Riedemann <email address hidden>
Date: Fri Nov 9 11:30:44 2018 -0500

    Mention meta key suffix in tenant isolation with placement docs

    This changes does two things to the admin scheduler configuration
    docs:

    1. Notes the limitation from bug 1802111 for the older
       AggregateMultiTenancyIsolation filter and mentions that
       starting in Rocky, using tenant isolation with placement
       is better.

    2. Notes that when isolating tenants via placement, the metadata
       key "filter_tenant_id" can be suffixed to overcome the limitation
       in bug 1802111.

    Change-Id: I792c5df01b7cbc46c8363e261bc7422b09180e56
    Closes-Bug: #1802111

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/617535

Reviewed: https://review.openstack.org/617535
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=4c0342bf1d86bca2bedf1118b341295998d2c7f6
Submitter: Zuul
Branch: stable/rocky

commit 4c0342bf1d86bca2bedf1118b341295998d2c7f6
Author: Matt Riedemann <email address hidden>
Date: Fri Nov 9 11:30:44 2018 -0500

    Mention meta key suffix in tenant isolation with placement docs

    This changes does two things to the admin scheduler configuration
    docs:

    1. Notes the limitation from bug 1802111 for the older
       AggregateMultiTenancyIsolation filter and mentions that
       starting in Rocky, using tenant isolation with placement
       is better.

    2. Notes that when isolating tenants via placement, the metadata
       key "filter_tenant_id" can be suffixed to overcome the limitation
       in bug 1802111.

    Change-Id: I792c5df01b7cbc46c8363e261bc7422b09180e56
    Closes-Bug: #1802111
    (cherry picked from commit 1fa09acf08dacf94a435fbdaddc50eabfada48ec)

This issue was fixed in the openstack/nova 18.1.0 release.

This issue was fixed in the openstack/nova 19.0.0.0rc1 release candidate.