When a child project is created, it correctly shows itself as having a quota of 0 all around.
vagrant@vagrant:/opt/stack/cinder$ cinder quota-show 06a8c218aa4149b29560b251141ae6f1
+-----------------------+-------+
| Property | Value |
+-----------------------+-------+
| backup_gigabytes | 0 |
| backups | 0 |
| gigabytes | 0 |
| gigabytes_lvmdriver-1 | 0 |
| per_volume_gigabytes | 0 |
| snapshots | 0 |
| snapshots_lvmdriver-1 | 0 |
| volumes | 0 |
| volumes_lvmdriver-1 | 0 |
+-----------------------+-------+
However you can still create volume's without any issues, verifying the child quota is not getting enforced.
vagrant@vagrant:/opt/stack/cinder$ cinder quota-usage 06a8c218aa4149b29560b251141ae6f1
+-----------------------+--------+----------+-------+
| Type | In_use | Reserved | Limit |
+-----------------------+--------+----------+-------+
| backup_gigabytes | 0 | 0 | 0 |
| backups | 0 | 0 | 0 |
| gigabytes | 1 | 0 | 0 |
| gigabytes_lvmdriver-1 | 1 | 0 | 0 |
| per_volume_gigabytes | 0 | 0 | 0 |
| snapshots | 0 | 0 | 0 |
| snapshots_lvmdriver-1 | 0 | 0 | 0 |
| volumes | 1 | 0 | 0 |
| volumes_lvmdriver-1 | 1 | 0 | 0 |
+-----------------------+--------+----------+-------+
You can also see this by adding the following test case to test_quotas.py:
context = self.req.environ['cinder.context']
context.project_id = self.B.id
self.volume_type_name = CONF.default_volume_type
self.volume_type = db.volume_type_create(
context,
dict(name=self.volume_type_name))
self.addCleanup(db.volume_type_destroy, context,
self.volume_type['id'])
volume = {'name': 'my_vol_name',
'id': 'my_vol_id',
'size': 1,
'project_id': 'vol_project_id',
}
quota_utils.get_volume_type_reservation(context,
volume,
self.volume_type.id,
reserve_vol_type_only=True)
This issue seems to be caused by "parent_project_id" only getting passed in from the 'quota show' path and not as part of the 'create_volume' path, causing the non-child defaults to be used instead of the child default values.
To summarize, the issue is that we *can't* enforce child default quotas. The reason for this is because during actions like volume create (where we need to enforce quotas), we do not grab the parent_id for the project. However, since create volume is a non-admin action, we can't simply ask Keystone for the current project to get it's parent_project_id.
To solve this we are looking into the following (in preference order):
1) Adding parent_project_id to the Keystone token
2) Adding non-admin command in Keystone to retrieve parent_project_id
3) Use Cinder's "service" user
We will also discuss the general design for NestedQuotas to see if there's any changes we think should be made