Cinder quotas validation can be broken with skip_validation=False

[Ryan McNair]

The key and value that we're validating are one iteration out of sync when doing quota validation, see https://github.com/openstack/cinder/blob/master/cinder/api/contrib/quotas.py#L345

The only reason we don't get a runtime error the first time we try to access "value" is because it was previously defined as part of the loop variable.

https://github.com/openstack/cinder/blob/master/cinder/api/contrib/quotas.py#L305

[Ryan McNair (rdmcnair)]

This can be reproduced by changing this line (https://github.com/openstack/cinder/blob/master/cinder/tests/unit/api/contrib/test_quotas.py#L478) to:

    body = {'quota_set': {'gigabytes': 1, 'volumes': 10},

The test should still pass, because if everything was working, gigabytes: 1 would still get validated and the update would correctly fail. However, adding "volumes" to the update will cause the test to now fail

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/282068
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=c02336e4dd889b7b2a474488c4e964d08d558901
Submitter: Jenkins
Branch: master

commit c02336e4dd889b7b2a474488c4e964d08d558901
Author: Ryan McNair <email address hidden>
Date: Tue Feb 16 17:12:53 2016 +0000

    Re-enable -1 child limits for nested quotas

    Add back support for -1 limits of child projects. The way that we
    support the -1 child limits requires the following changes:
      * Continue quota validation up the hierarchy if the current limit is
        -1 until we hit a hard limit or no more parents, and update the
        any relevant parents' allocated value along the way
      * When updating limits, special care needs to be taken when updating
        child limit to be -1, or when changing from a -1 limit
      * Enable support for creating reservations for "allocated" values
        to support the scenario that:
          - a volume is created on a project with a limit of -1
          - the parent's allocated value has been updated appropriately
          - the volume create fails and the child's in_use quota rolls back
          - now we must also rollback the parent's allocated value

    NOTE: There is a race condition between validation the NestedQuotas
    and when the driver may be switched into use, and if -1 quotas are used
    the validation could be out of date. Will look into better support for
    switching on of NestedQuotas on live deployment with -1 limits, which
    would likely leverage the "allocated" reservation system.

    Closes-Bug: #1548645
    Closes-Bug: #1544774
    Closes-Bug: #1537189
    Change-Id: I2d1dba87baf3595cc8f48574e0281ac17509fe7d

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/cinder 8.0.0.0b3 development milestone.