Add OS::Nova::Quota resource
This creates a new resource type whose intended use case is for admin-only use and to manage the Compute service quotas for projects. implements bp nova-quota-resource Change-Id: Iffd72e8226536855221e856d3d92d8941c61d9c0
This commit is contained in:
Yosef Hoffman
@@ -88,6 +88,7 @@
|
|||||||
"resource_types:OS::Cinder::EncryptedVolumeType": "rule:project_admin",
|
"resource_types:OS::Cinder::EncryptedVolumeType": "rule:project_admin",
|
||||||
"resource_types:OS::Cinder::VolumeType": "rule:project_admin",
|
"resource_types:OS::Cinder::VolumeType": "rule:project_admin",
|
||||||
"resource_types:OS::Cinder::Quota": "rule:project_admin",
|
"resource_types:OS::Cinder::Quota": "rule:project_admin",
|
||||||
|
"resource_types:OS::Nova::Quota": "rule:project_admin",
|
||||||
"resource_types:OS::Manila::ShareType": "rule:project_admin",
|
"resource_types:OS::Manila::ShareType": "rule:project_admin",
|
||||||
"resource_types:OS::Neutron::QoSPolicy": "rule:project_admin",
|
"resource_types:OS::Neutron::QoSPolicy": "rule:project_admin",
|
||||||
"resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin",
|
"resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin",
|
||||||
|
|||||||
249
heat/engine/resources/openstack/nova/quota.py
Normal file
249
heat/engine/resources/openstack/nova/quota.py
Normal file
@@ -0,0 +1,249 @@
|
|||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
|
||||||
|
import copy
|
||||||
|
|
||||||
|
from heat.common import exception
|
||||||
|
from heat.common.i18n import _
|
||||||
|
from heat.engine import constraints
|
||||||
|
from heat.engine import properties
|
||||||
|
from heat.engine import resource
|
||||||
|
from heat.engine import support
|
||||||
|
from heat.engine import translation
|
||||||
|
|
||||||
|
|
||||||
|
class NovaQuota(resource.Resource):
|
||||||
|
"""A resource for creating nova quotas.
|
||||||
|
|
||||||
|
Nova Quota is used to manage operational limits for projects. Currently,
|
||||||
|
this resource can manage Nova's quotas for:
|
||||||
|
- cores
|
||||||
|
- fixed_ips
|
||||||
|
- floating_ips
|
||||||
|
- instances
|
||||||
|
- injected_files
|
||||||
|
- injected_file_content_bytes
|
||||||
|
- injected_file_path_bytes
|
||||||
|
- key_pairs
|
||||||
|
- metadata_items
|
||||||
|
- ram
|
||||||
|
- security_groups
|
||||||
|
- security_group_rules
|
||||||
|
- server_groups
|
||||||
|
- server_group_members
|
||||||
|
|
||||||
|
Note that default nova security policy usage of this resource
|
||||||
|
is limited to being used by administrators only. Administrators should be
|
||||||
|
careful to create only one Nova Quota resource per project, otherwise
|
||||||
|
it will be hard for them to manage the quota properly.
|
||||||
|
"""
|
||||||
|
|
||||||
|
support_status = support.SupportStatus(version='8.0.0')
|
||||||
|
|
||||||
|
default_client_name = 'nova'
|
||||||
|
|
||||||
|
entity = 'quotas'
|
||||||
|
|
||||||
|
required_service_extension = 'os-quota-sets'
|
||||||
|
|
||||||
|
PROPERTIES = (
|
||||||
|
PROJECT, CORES, FIXED_IPS, FLOATING_IPS, INSTANCES,
|
||||||
|
INJECTED_FILES, INJECTED_FILE_CONTENT_BYTES, INJECTED_FILE_PATH_BYTES,
|
||||||
|
KEYPAIRS, METADATA_ITEMS, RAM, SECURITY_GROUPS, SECURITY_GROUP_RULES,
|
||||||
|
SERVER_GROUPS, SERVER_GROUP_MEMBERS
|
||||||
|
) = (
|
||||||
|
'project', 'cores', 'fixed_ips', 'floating_ips', 'instances',
|
||||||
|
'injected_files', 'injected_file_content_bytes',
|
||||||
|
'injected_file_path_bytes', 'key_pairs', 'metadata_items', 'ram',
|
||||||
|
'security_groups', 'security_group_rules', 'server_groups',
|
||||||
|
'server_group_members'
|
||||||
|
)
|
||||||
|
|
||||||
|
properties_schema = {
|
||||||
|
PROJECT: properties.Schema(
|
||||||
|
properties.Schema.STRING,
|
||||||
|
_('Name or id of the project to set the quota for.'),
|
||||||
|
required=True,
|
||||||
|
constraints=[
|
||||||
|
constraints.CustomConstraint('keystone.project')
|
||||||
|
]
|
||||||
|
),
|
||||||
|
CORES: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of cores. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
FIXED_IPS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of fixed IPs. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
FLOATING_IPS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of floating IPs. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
INSTANCES: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of instances. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
INJECTED_FILES: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of injected files. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
INJECTED_FILE_CONTENT_BYTES: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of injected file content bytes. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
INJECTED_FILE_PATH_BYTES: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of injected file path bytes. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
KEYPAIRS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of key pairs. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
METADATA_ITEMS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of metadata items. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
RAM: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the amount of ram (in megabytes). '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
SECURITY_GROUPS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of security groups. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
SECURITY_GROUP_RULES: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of security group rules. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
SERVER_GROUPS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of server groups. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
),
|
||||||
|
SERVER_GROUP_MEMBERS: properties.Schema(
|
||||||
|
properties.Schema.INTEGER,
|
||||||
|
_('Quota for the number of server group members. '
|
||||||
|
'Setting the value to -1 removes the limit.'),
|
||||||
|
constraints=[
|
||||||
|
constraints.Range(min=-1),
|
||||||
|
],
|
||||||
|
update_allowed=True
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
def translation_rules(self, props):
|
||||||
|
return [
|
||||||
|
translation.TranslationRule(
|
||||||
|
props,
|
||||||
|
translation.TranslationRule.RESOLVE,
|
||||||
|
[self.PROJECT],
|
||||||
|
client_plugin=self.client_plugin('keystone'),
|
||||||
|
finder='get_project_id')
|
||||||
|
]
|
||||||
|
|
||||||
|
def handle_create(self):
|
||||||
|
self._set_quota()
|
||||||
|
self.resource_id_set(self.physical_resource_name())
|
||||||
|
|
||||||
|
def handle_update(self, json_snippet, tmpl_diff, prop_diff):
|
||||||
|
self._set_quota(json_snippet.properties(self.properties_schema,
|
||||||
|
self.context))
|
||||||
|
|
||||||
|
def _set_quota(self, props=None):
|
||||||
|
if props is None:
|
||||||
|
props = self.properties
|
||||||
|
|
||||||
|
args = copy.copy(props.data)
|
||||||
|
project = args.pop(self.PROJECT)
|
||||||
|
|
||||||
|
self.client().quotas.update(project, **args)
|
||||||
|
|
||||||
|
def handle_delete(self):
|
||||||
|
self.client().quotas.delete(self.properties[self.PROJECT])
|
||||||
|
|
||||||
|
def validate(self):
|
||||||
|
super(NovaQuota, self).validate()
|
||||||
|
if len(self.properties.data) == 1:
|
||||||
|
raise exception.PropertyUnspecifiedError(
|
||||||
|
*sorted(set(self.PROPERTIES) - {self.PROJECT}))
|
||||||
|
|
||||||
|
|
||||||
|
def resource_mapping():
|
||||||
|
return {
|
||||||
|
'OS::Nova::Quota': NovaQuota
|
||||||
|
}
|
||||||
167
heat/tests/openstack/nova/test_quota.py
Normal file
167
heat/tests/openstack/nova/test_quota.py
Normal file
@@ -0,0 +1,167 @@
|
|||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
import mock
|
||||||
|
import six
|
||||||
|
|
||||||
|
from heat.common import exception
|
||||||
|
from heat.common import template_format
|
||||||
|
from heat.engine.clients.os import keystone as k_plugin
|
||||||
|
from heat.engine.clients.os import nova as n_plugin
|
||||||
|
from heat.engine import rsrc_defn
|
||||||
|
from heat.engine import stack as parser
|
||||||
|
from heat.engine import template
|
||||||
|
from heat.tests import common
|
||||||
|
from heat.tests import utils
|
||||||
|
|
||||||
|
quota_template = '''
|
||||||
|
heat_template_version: newton
|
||||||
|
|
||||||
|
description: Sample nova quota heat template
|
||||||
|
|
||||||
|
resources:
|
||||||
|
my_quota:
|
||||||
|
type: OS::Nova::Quota
|
||||||
|
properties:
|
||||||
|
project: demo
|
||||||
|
cores: 5
|
||||||
|
fixed_ips: 5
|
||||||
|
floating_ips: 5
|
||||||
|
instances: 5
|
||||||
|
injected_files: 5
|
||||||
|
injected_file_content_bytes: 5
|
||||||
|
injected_file_path_bytes: 5
|
||||||
|
key_pairs: 5
|
||||||
|
metadata_items: 5
|
||||||
|
ram: 5
|
||||||
|
security_groups: 5
|
||||||
|
security_group_rules: 5
|
||||||
|
server_groups: 5
|
||||||
|
server_group_members: 5
|
||||||
|
'''
|
||||||
|
|
||||||
|
valid_properties = [
|
||||||
|
'cores', 'fixed_ips', 'floating_ips', 'instances', 'injected_files',
|
||||||
|
'injected_file_content_bytes', 'injected_file_path_bytes', 'key_pairs',
|
||||||
|
'metadata_items', 'ram', 'security_groups', 'security_group_rules',
|
||||||
|
'server_groups', 'server_group_members'
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
class NovaQuotaTest(common.HeatTestCase):
|
||||||
|
def setUp(self):
|
||||||
|
super(NovaQuotaTest, self).setUp()
|
||||||
|
|
||||||
|
self.ctx = utils.dummy_context()
|
||||||
|
self.patchobject(n_plugin.NovaClientPlugin, 'has_extension',
|
||||||
|
return_value=True)
|
||||||
|
self.patchobject(k_plugin.KeystoneClientPlugin, 'get_project_id',
|
||||||
|
return_value='some_project_id')
|
||||||
|
tpl = template_format.parse(quota_template)
|
||||||
|
self.stack = parser.Stack(
|
||||||
|
self.ctx, 'nova_quota_test_stack',
|
||||||
|
template.Template(tpl)
|
||||||
|
)
|
||||||
|
|
||||||
|
self.my_quota = self.stack['my_quota']
|
||||||
|
nova = mock.MagicMock()
|
||||||
|
self.novaclient = mock.MagicMock()
|
||||||
|
self.my_quota.client = nova
|
||||||
|
nova.return_value = self.novaclient
|
||||||
|
self.quotas = self.novaclient.quotas
|
||||||
|
self.quota_set = mock.MagicMock()
|
||||||
|
self.quotas.update.return_value = self.quota_set
|
||||||
|
self.quotas.delete.return_value = self.quota_set
|
||||||
|
|
||||||
|
def _test_validate(self, resource, error_msg):
|
||||||
|
exc = self.assertRaises(exception.StackValidationFailed,
|
||||||
|
resource.validate)
|
||||||
|
self.assertIn(error_msg, six.text_type(exc))
|
||||||
|
|
||||||
|
def _test_invalid_property(self, prop_name):
|
||||||
|
my_quota = self.stack['my_quota']
|
||||||
|
props = self.stack.t.t['resources']['my_quota']['properties'].copy()
|
||||||
|
props[prop_name] = -2
|
||||||
|
my_quota.t = my_quota.t.freeze(properties=props)
|
||||||
|
my_quota.reparse()
|
||||||
|
error_msg = ('Property error: resources.my_quota.properties.%s:'
|
||||||
|
' -2 is out of range (min: -1, max: None)' % prop_name)
|
||||||
|
self._test_validate(my_quota, error_msg)
|
||||||
|
|
||||||
|
def test_invalid_properties(self):
|
||||||
|
for prop in valid_properties:
|
||||||
|
self._test_invalid_property(prop)
|
||||||
|
|
||||||
|
def test_miss_all_quotas(self):
|
||||||
|
my_quota = self.stack['my_quota']
|
||||||
|
props = self.stack.t.t['resources']['my_quota']['properties'].copy()
|
||||||
|
for key in valid_properties:
|
||||||
|
if key in props:
|
||||||
|
del props[key]
|
||||||
|
my_quota.t = my_quota.t.freeze(properties=props)
|
||||||
|
my_quota.reparse()
|
||||||
|
msg = ('At least one of the following properties must be specified: '
|
||||||
|
'cores, fixed_ips, floating_ips, injected_file_content_bytes, '
|
||||||
|
'injected_file_path_bytes, injected_files, instances, '
|
||||||
|
'key_pairs, metadata_items, ram, security_group_rules, '
|
||||||
|
'security_groups, server_group_members, server_groups.')
|
||||||
|
self.assertRaisesRegexp(exception.PropertyUnspecifiedError, msg,
|
||||||
|
my_quota.validate)
|
||||||
|
|
||||||
|
def test_quota_handle_create(self):
|
||||||
|
self.my_quota.physical_resource_name = mock.MagicMock(
|
||||||
|
return_value='some_resource_id')
|
||||||
|
self.my_quota.reparse()
|
||||||
|
self.my_quota.handle_create()
|
||||||
|
self.quotas.update.assert_called_once_with(
|
||||||
|
'some_project_id',
|
||||||
|
cores=5,
|
||||||
|
fixed_ips=5,
|
||||||
|
floating_ips=5,
|
||||||
|
instances=5,
|
||||||
|
injected_files=5,
|
||||||
|
injected_file_content_bytes=5,
|
||||||
|
injected_file_path_bytes=5,
|
||||||
|
key_pairs=5,
|
||||||
|
metadata_items=5,
|
||||||
|
ram=5,
|
||||||
|
security_groups=5,
|
||||||
|
security_group_rules=5,
|
||||||
|
server_groups=5,
|
||||||
|
server_group_members=5
|
||||||
|
)
|
||||||
|
self.assertEqual('some_resource_id', self.my_quota.resource_id)
|
||||||
|
|
||||||
|
def test_quota_handle_update(self):
|
||||||
|
tmpl_diff = mock.MagicMock()
|
||||||
|
prop_diff = mock.MagicMock()
|
||||||
|
props = {'project': 'some_project_id', 'cores': 1, 'fixed_ips': 2,
|
||||||
|
'instances': 3, 'injected_file_content_bytes': 4, 'ram': 200}
|
||||||
|
json_snippet = rsrc_defn.ResourceDefinition(
|
||||||
|
self.my_quota.name,
|
||||||
|
'OS::Nova::Quota',
|
||||||
|
properties=props)
|
||||||
|
self.my_quota.reparse()
|
||||||
|
self.my_quota.handle_update(json_snippet, tmpl_diff, prop_diff)
|
||||||
|
self.quotas.update.assert_called_once_with(
|
||||||
|
'some_project_id',
|
||||||
|
cores=1,
|
||||||
|
fixed_ips=2,
|
||||||
|
instances=3,
|
||||||
|
injected_file_content_bytes=4,
|
||||||
|
ram=200
|
||||||
|
)
|
||||||
|
|
||||||
|
def test_quota_handle_delete(self):
|
||||||
|
self.my_quota.reparse()
|
||||||
|
self.my_quota.handle_delete()
|
||||||
|
self.quotas.delete.assert_called_once_with('some_project_id')
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
features:
|
||||||
|
- New resource ``OS::Nova::Quota`` is added to enable an admin to manage
|
||||||
|
Compute service quotas for a specific project.
|
||||||
Reference in New Issue
Block a user