Manage Networking service quotas

Manage Networking service quotas

A quota limits the number of available resources. A default quota might be enforced for all projects. When you try to create more resources than the quota allows, an error occurs:

$ openstack network create test_net
 Error while executing command: ConflictException: 409, Quota exceeded for resources: ['network'].

Per-project quota configuration is also supported by the quota extension API. See Configure per-project quotas for details.

Basic quota configuration

In the Networking default quota mechanism, all projects have the same quota values, such as the number of resources that a project can create.

The quota value is defined in the OpenStack Networking /etc/neutron/neutron.conf configuration file. This example shows the default quota values:

[quotas]
# Default number of resources allowed per project. A negative value means
# unlimited. (integer value)
#default_quota = -1

# Number of networks allowed per project. A negative value means unlimited.
# (integer value)
quota_network = 100

# Number of subnets allowed per project, A negative value means unlimited.
# (integer value)
quota_subnet = 100

# Number of ports allowed per project. A negative value means unlimited.
# (integer value)
quota_port = 500

# default driver to use for quota checks
quota_driver = neutron.db.quota.driver_nolock.DbQuotaNoLockDriver

# When set to True, quota usage will be tracked in the Neutron database
# for each resource, by directly mapping to a data model class, for
# example, networks, subnets, ports, etc. When set to False, quota usage
# will be tracked by the quota engine as a count of the object type
# directly. For more information, see the Quota Management and
# Enforcement guide.
# (boolean value)
track_quota_usage = true

#
# From neutron.extensions
#

# Number of routers allowed per project. A negative value means unlimited.
# (integer value)
quota_router = 10

# Number of floating IPs allowed per project. A negative value means
# unlimited.
# (integer value)
quota_floatingip = 50

# Number of security groups allowed per project. A negative value means
# unlimited.
# (integer value)
quota_security_group = 10

# Number of security group rules allowed per project. A negative value means
# unlimited.
# (integer value)
quota_security_group_rule = 100

Configure per-project quotas

OpenStack Networking also supports per-project quota limit by quota extension API.

Use these commands to manage per-project quotas:

openstack quota delete

Delete defined quotas for a specified project

openstack quota list

Lists defined quotas for all projects with non-default quota values

openstack quota show

Shows defined quotas for all projects

openstack quota show <project>

Shows quotas for a specified project

openstack quota show –default <project>

Show default quotas for a specified project

openstack quota set –<resource> <value> <project>

Updates quotas for a specified project

Only users with the admin role can change a quota value. By default, the default set of quotas are enforced for all projects, so no opentack quota create command exists.

  1. Configure Networking to show per-project quotas

    Set the quota_driver option in the /etc/neutron/neutron.conf file.

    quota_driver = neutron.db.quota.driver.DbQuotaDriver
    

    When you set this option, the output for Networking commands shows quotas.

  2. List Networking extensions.

    To list the Networking extensions, run this command:

    $ openstack extension list --network
    

    The command shows the quotas extension, which provides per-project quota management support.

    +------------------------+------------------------+--------------------------+
    | Name                   | Alias                  | Description              |
    +------------------------+------------------------+--------------------------+
    | ...                    | ...                    | ...                      |
    | Quota management       | quotas                 | Expose functions for     |
    | support                |                        | quotas management per    |
    |                        |                        | project                  |
    | ...                    | ...                    | ...                      |
    +------------------------+------------------------+--------------------------+
    
  3. Show information for the quotas extension.

    To show information for the quotas extension, run this command:

    $ openstack extension show quotas
    +-------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    | Field       | Value                                                                                                                                                                                     |
    +-------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    | alias       | quotas                                                                                                                                                                                    |
    | description | Expose functions for quotas management per project                                                                                                                                        |
    | id          | quotas                                                                                                                                                                                    |
    | links       | []                                                                                                                                                                                        |
    | location    | Munch({'cloud': '', 'region_name': 'RegionOne', 'zone': None, 'project': Munch({'id': 'afc55714081b4ef29f99ec128cb1fa30', 'name': 'demo', 'domain_id': 'default', 'domain_name': None})}) |
    | name        | Quota management support                                                                                                                                                                  |
    | updated     | 2012-07-29T10:00:00-00:00                                                                                                                                                                 |
    +-------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    

    Note

    Only some plug-ins support per-project quotas. Specifically, OVN, Open vSwitch, Linux Bridge, and VMware NSX support them, but new versions of other plug-ins might bring additional functionality. See the documentation for each plug-in.

  4. List projects who have per-project quota support.

    The openstack quota list command lists projects for which the per-project quota is enabled. The command does not list projects with default quota support. You must be an administrative user to run this command:

    $ openstack quota list --network
    +----------------------------------+--------------+----------+-------+---------------+---------+-----------------+----------------------+---------+--------------+
    | Project ID                       | Floating IPs | Networks | Ports | RBAC Policies | Routers | Security Groups | Security Group Rules | Subnets | Subnet Pools |
    +----------------------------------+--------------+----------+-------+---------------+---------+-----------------+----------------------+---------+--------------+
    | 6f88036c45344d9999a1f971e4882723 |           50 |      100 |   500 |            10 |      20 |              10 |                  100 |     100 |           -1 |
    | bff5c9455ee24231b5bc713c1b96d422 |          100 |      100 |   500 |            10 |      10 |              10 |                  100 |     100 |           -1 |
    +----------------------------------+--------------+----------+-------+---------------+---------+-----------------+----------------------+---------+--------------+
    
  5. Show per-project quota values.

    The openstack quota show command reports the current set of quota limits for the specified project. Non-administrative users can run this command without the <project> argument. If per-project quota limits are not enabled for the project, the command shows the default set of quotas.

    $ openstack quota show 6f88036c45344d9999a1f971e4882723
    +----------------+-------+
    | Resource       | Limit |
    +----------------+-------+
    | networks       |   100 |
    | ports          |   500 |
    | rbac_policies  |    10 |
    | routers        |    20 |
    | subnets        |   100 |
    | subnet_pools   |    -1 |
    | floating-ips   |    50 |
    | secgroup-rules |   100 |
    | secgroups      |    10 |
    +----------------+-------+
    

    The following command shows the command output for a non-administrative user.

    $ openstack quota show
    +----------------+-------+
    | Resource       | Limit |
    +----------------+-------+
    | networks       |   100 |
    | ports          |   500 |
    | rbac_policies  |    10 |
    | routers        |    20 |
    | subnets        |   100 |
    | subnet_pools   |    -1 |
    | floating-ips   |    50 |
    | secgroup-rules |   100 |
    | secgroups      |    10 |
    +----------------+-------+
    
  6. Update quota values for a specified project.

    Use the openstack quota set command to update a quota for a specified project.

    $ openstack quota set --routers 20 6f88036c45344d9999a1f971e4882723
    

    You can update quotas for multiple resources through one command.

    $ openstack quota set --subnets 50 --ports 100 6f88036c45344d9999a1f971e4882723
    

    You can update the limits of multiple resources through one command:

    $ openstack quota set --networks 50 --subnets 50 --ports 100 \
      --floating-ips 20 --routers 5 6f88036c45344d9999a1f971e4882723
    
  7. Delete per-project quota values.

    To clear per-project quota limits, use the openstack quota delete command.

    $ openstack quota delete 6f88036c45344d9999a1f971e4882723
    

    After you run this command, you can see that quota values for the project are reset to the default values.

    $ openstack quota show --network 6f88036c45344d9999a1f971e4882723
    +----------------+-------+
    | Resource       | Limit |
    +----------------+-------+
    | networks       |   100 |
    | ports          |   500 |
    | rbac_policies  |    10 |
    | routers        |    20 |
    | subnets        |   100 |
    | subnet_pools   |    -1 |
    | floating-ips   |    50 |
    | secgroup-rules |   100 |
    | secgroups      |    10 |
    +----------------+-------+
    

Note

Listing default quotas with the OpenStack command line client will provide all quotas for networking and other services.

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.