Public bug reported: Colleagues working downstream found a slight discrepancy in quota enforcement while working with the new unified quota system.
If we set the image_size_total quota to 1 MiB, the actual limit where quota enforcement turns on is 2 MiB - 1 byte: openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 1 --region RegionOne image_size_total openstack image list -f value -c ID | xargs -r openstack image delete openstack image create --file <( dd if=/dev/zero bs=1 count=$(( 2 * 1024 ** 2 - 1 )) ) img1 ## succeeds openstack image create --file <( dd if=/dev/zero bs=1 count=1 ) img2 ## succeeds openstack image list -f value -c ID | xargs -r openstack image delete openstack image create --file <( dd if=/dev/zero bs=1 count=$(( 2 * 1024 ** 2 )) ) img1 ## succeeds openstack image create --file <( dd if=/dev/zero bs=1 count=1 ) img2 ## HttpException: 413: ... Request Entity Too Large This bug report is not about the size of img1 - we know that the limit is soft and img1 can go over the quota - but the success/failure of 'image create img2'. I believe the root cause is an integer/floor division when calculating the usage in megabytes. My colleagues also proposed a fix, which I am going to upload right after opening this ticket. Environment details: glance 199722a65 devstack 0d5c8d66 Quota setup as described in: https://docs.openstack.org/glance/latest/admin/quotas.html $ for opt in image_stage_total image_count_total image_count_uploading ; do openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 999999 --region RegionOne $opt ; done $ openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 1 --region RegionOne image_size_total +---------------+----------------------------------+ | Field | Value | +---------------+----------------------------------+ | default_limit | 1 | | description | None | | id | 828fe62d931449d08d96f725226891d4 | | region_id | RegionOne | | resource_name | image_size_total | | service_id | 3400473cffa047edb79c67383e86072d | +---------------+----------------------------------+ $ source openrc admin admin $ openstack user create --password devstack glance-service +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | 43268355b8f64d399a7a35535ffee399 | | name | glance-service | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+ $ openstack role add --user glance-service --user-domain Default --system all reader $ echo $OS_AUTH_URL http://192.168.122.218/identity $ openstack endpoint list --service glance +----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+ | ID | Region | Service Name | Service Type | Enabled | Interface | URL | +----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+ | 92995b7a76444502acbbecfb421d0bc1 | RegionOne | glance | image | True | public | http://192.168.122.218/image | +----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+ $ vi /etc/glance/glance-api [DEFAULT] use_keystone_limits = True [oslo_limit] auth_url = http://192.168.122.218/identity auth_type = password user_domain_id = default username = glance-service system_scope = all password = devstack endpoint_id = 92995b7a76444502acbbecfb421d0bc1 region_name = RegionOne $ sudo systemctl restart devstack@g-api.service ** Affects: glance Importance: Undecided Status: In Progress -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Glance. https://bugs.launchpad.net/bugs/1998820 Title: Floor division in size usage calculation leads to surprising quota limits Status in Glance: In Progress Bug description: Colleagues working downstream found a slight discrepancy in quota enforcement while working with the new unified quota system. If we set the image_size_total quota to 1 MiB, the actual limit where quota enforcement turns on is 2 MiB - 1 byte: openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 1 --region RegionOne image_size_total openstack image list -f value -c ID | xargs -r openstack image delete openstack image create --file <( dd if=/dev/zero bs=1 count=$(( 2 * 1024 ** 2 - 1 )) ) img1 ## succeeds openstack image create --file <( dd if=/dev/zero bs=1 count=1 ) img2 ## succeeds openstack image list -f value -c ID | xargs -r openstack image delete openstack image create --file <( dd if=/dev/zero bs=1 count=$(( 2 * 1024 ** 2 )) ) img1 ## succeeds openstack image create --file <( dd if=/dev/zero bs=1 count=1 ) img2 ## HttpException: 413: ... Request Entity Too Large This bug report is not about the size of img1 - we know that the limit is soft and img1 can go over the quota - but the success/failure of 'image create img2'. I believe the root cause is an integer/floor division when calculating the usage in megabytes. My colleagues also proposed a fix, which I am going to upload right after opening this ticket. Environment details: glance 199722a65 devstack 0d5c8d66 Quota setup as described in: https://docs.openstack.org/glance/latest/admin/quotas.html $ for opt in image_stage_total image_count_total image_count_uploading ; do openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 999999 --region RegionOne $opt ; done $ openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 1 --region RegionOne image_size_total +---------------+----------------------------------+ | Field | Value | +---------------+----------------------------------+ | default_limit | 1 | | description | None | | id | 828fe62d931449d08d96f725226891d4 | | region_id | RegionOne | | resource_name | image_size_total | | service_id | 3400473cffa047edb79c67383e86072d | +---------------+----------------------------------+ $ source openrc admin admin $ openstack user create --password devstack glance-service +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | domain_id | default | | enabled | True | | id | 43268355b8f64d399a7a35535ffee399 | | name | glance-service | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+ $ openstack role add --user glance-service --user-domain Default --system all reader $ echo $OS_AUTH_URL http://192.168.122.218/identity $ openstack endpoint list --service glance +----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+ | ID | Region | Service Name | Service Type | Enabled | Interface | URL | +----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+ | 92995b7a76444502acbbecfb421d0bc1 | RegionOne | glance | image | True | public | http://192.168.122.218/image | +----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+ $ vi /etc/glance/glance-api [DEFAULT] use_keystone_limits = True [oslo_limit] auth_url = http://192.168.122.218/identity auth_type = password user_domain_id = default username = glance-service system_scope = all password = devstack endpoint_id = 92995b7a76444502acbbecfb421d0bc1 region_name = RegionOne $ sudo systemctl restart devstack@g-api.service To manage notifications about this bug go to: https://bugs.launchpad.net/glance/+bug/1998820/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
