rbac_policy quota should be configurable

[Giuseppe Petralia]

Currently default quota for rbac policy is set 10 for any new project created:

$ neutron quota-show --tenant_id $(openstack project show admin --format value -c id) | grep rbac
| rbac_policy | 10 |

As an operator I would like to be able to set a different default quota.

Currently I can only set the following quota:
$ juju config neutron-api | grep quota-
  quota-floatingip:
  quota-health-monitors:
  quota-member:
  quota-network:
  quota-pool:
  quota-port:
  quota-router:
  quota-security-group:
  quota-security-group-rule:
  quota-subnet:
  quota-vip:

Also there are cases where the number of shared networks are above the rbac_policy quota so a new project comes with a number of rbac policies already in place that is above the quota and user can't create any rbac without increasing the default or set to -1.

I could not find any reference to the rbac quota and how to set on upstream doc for neutron.conf, we should evaluate if this is an upstream bug as well.

https://docs.openstack.org/neutron/latest/configuration/neutron.html#quotas.default_quota

[Adam Dyess (addyess)]

Looking into the neutron code [1], it may be a missing documentation around the option:
Please add to the charm as well.

quota_rbac_policy - Default number of RBAC entries allowed per tenant. A negative value means unlimited.

[1] https://github.com/openstack/neutron/blob/1ad9ca56b07ffdc9f7e0bc6a62af61961b9128eb/neutron/conf/quota.py#L91

[Adam Dyess (addyess)]

I did find this documentation around the ocata docs
https://docs.openstack.org/ocata/config-reference/networking/networking_options_reference.html

But it seems to have vanished from more current release documentation