Quotas should be assignable at the domain level such that all projects in a domain are re-allocated their quota from the domain level. This allows public cloud providers to allocate quota at the customer level and then customer is responsible for redistrbuting those allowances across their projects. Multi-region support as well - if that exist.
"(Henry Nash): In fact, no change needed in Keystone. Domains are actually represented in keystone as projects with a special attribute (is_domain=True). Hence all that is needed is that services that have quotas to handle the ""root"" of a project hierarchy (which is a project representing the domain) as being able to hold a quota. Q (tobberydberg): So subprojects of ""domain"" project cannot allocate more resourses in total than the quota of the ""domain"" project?Well, that would depend on the quota model chosen (i.e. do you support over-commit or not). There is a cross-project spec that is in the works which would make keystone the common store of quoto limits, but the actual algorithms and calcaulations will remain in the individual services.
(Tim Bell) This is very close to the nested quota model which the scientific working group has been encouraging (https://openstack-in-production.blogspot.fr/2016/04/resource-management-at-cern.html). There is clearly further work to be done after the quotas (such as customers can upload an image which is available to projects lower in the tree) but quotas is the first step."
Reference specs:
https://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/unified-limits.html
https://etherpad.openstack.org/p/BOS-forum-quotas
We have a specification that might address this up for review for Rocky [0].
[0] https:/