Floor division in size usage calculation leads to surprising quota limits

[Bence Romsics]

Colleagues working downstream found a slight discrepancy in quota enforcement while working with the new unified quota system.

If we set the image_size_total quota to 1 MiB, the actual limit where quota enforcement turns on is 2 MiB - 1 byte:

openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 1 --region RegionOne image_size_total

openstack image list -f value -c ID | xargs -r openstack image delete
openstack image create --file <( dd if=/dev/zero bs=1 count=$(( 2 * 1024 ** 2 - 1 )) ) img1 ## succeeds
openstack image create --file <( dd if=/dev/zero bs=1 count=1 ) img2 ## succeeds

openstack image list -f value -c ID | xargs -r openstack image delete
openstack image create --file <( dd if=/dev/zero bs=1 count=$(( 2 * 1024 ** 2 )) ) img1 ## succeeds
openstack image create --file <( dd if=/dev/zero bs=1 count=1 ) img2 ## HttpException: 413: ... Request Entity Too Large

This bug report is not about the size of img1 - we know that the limit is soft and img1 can go over the quota - but the success/failure of 'image create img2'.

I believe the root cause is an integer/floor division when calculating the usage in megabytes. My colleagues also proposed a fix, which I am going to upload right after opening this ticket.

Environment details:

glance 199722a65
devstack 0d5c8d66

Quota setup as described in: https://docs.openstack.org/glance/latest/admin/quotas.html

$ for opt in image_stage_total image_count_total image_count_uploading ; do openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 999999 --region RegionOne $opt ; done
$ openstack --os-cloud devstack-system-admin registered limit create --service glance --default-limit 1 --region RegionOne image_size_total
+---------------+----------------------------------+
| Field | Value |
+---------------+----------------------------------+
| default_limit | 1 |
| description | None |
| id | 828fe62d931449d08d96f725226891d4 |
| region_id | RegionOne |
| resource_name | image_size_total |
| service_id | 3400473cffa047edb79c67383e86072d |
+---------------+----------------------------------+

$ source openrc admin admin

$ openstack user create --password devstack glance-service
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 43268355b8f64d399a7a35535ffee399 |
| name | glance-service |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
$ openstack role add --user glance-service --user-domain Default --system all reader

$ echo $OS_AUTH_URL
http://192.168.122.218/identity
$ openstack endpoint list --service glance
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+
| 92995b7a76444502acbbecfb421d0bc1 | RegionOne | glance | image | True | public | http://192.168.122.218/image |
+----------------------------------+-----------+--------------+--------------+---------+-----------+------------------------------+

$ vi /etc/glance/glance-api
[DEFAULT]
use_keystone_limits = True
[oslo_limit]
auth_url = http://192.168.122.218/identity
auth_type = password
user_domain_id = default
username = glance-service
system_scope = all
password = devstack
endpoint_id = 92995b7a76444502acbbecfb421d0bc1
region_name = RegionOne

$ sudo systemctl restart <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/glance/+/866584