<div dir="ltr">Extra eyes on the API would be appreciated. We're also close to the point where we can start incorporating oslo.limit into services, so preparing those changes might be useful, too.<div><br></div><div>One of the outcomes from yesterday's session was that Jay and Mel (from nova) were going to work out some examples we could use to finish up the enforcement code in oslo.limit. Helping out with that or picking it up would certainly help move the ball forward in nova.</div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Sep 11, 2018 at 1:15 AM Jaze Lee <<a href="mailto:jazeltq@gmail.com">jazeltq@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I recommend <a href="mailto:lijie@unitedstack.com" target="_blank">lijie@unitedstack.com</a> to join in to help to work forward.<br>
May be first we should the keystone unified limits api really ok or<br>
something else ?<br>
<br>
Lance Bragstad <<a href="mailto:lbragstad@gmail.com" target="_blank">lbragstad@gmail.com</a>> 于2018年9月8日周六 上午2:35写道：<br>
><br>
> That would be great! I can break down the work a little bit to help describe where we are at with different parts of the initiative. Hopefully it will be useful for your colleagues in case they haven't been closely following the effort.<br>
><br>
> # keystone<br>
><br>
> Based on the initial note in this thread, I'm sure you're aware of keystone's status with respect to unified limits. But to recap, the initial implementation landed in Queens and targeted flat enforcement [0]. During the Rocky PTG we sat down with other services and a few operators to explain the current status in keystone and if either developers or operators had feedback on the API specifically. Notes were captured in etherpad [1]. We spent the Rocky cycle fixing usability issues with the API [2] and implementing support for a hierarchical enforcement model [3].<br>
><br>
> At this point keystone is ready for services to start consuming the unified limits work. The unified limits API is still marked as stable and it will likely stay that way until we have at least one project using unified limits. We can use that as an opportunity to do a final flush of any changes that need to be made to the API before fully supporting it. The keystone team expects that to be a quick transition, as we don't want to keep the API hanging in an experimental state. It's really just a safe guard to make sure we have the opportunity to use it in another service before fully committing to the API. Ultimately, we don't want to prematurely mark the API as supported when other services aren't even using it yet, and then realize it has issues that could have been fixed prior to the adoption phase.<br>
><br>
> # oslo.limit<br>
><br>
> In parallel with the keystone work, we created a new library to aid services in consuming limits. Currently, the sole purpose of oslo.limit is to abstract project and project hierarchy information away from the service, so that services don't have to reimplement client code to understand project trees, which could arguably become complex and lead to inconsistencies in u-x across services.<br>
><br>
> Ideally, a service should be able to pass some relatively basic information to oslo.limit and expect an answer on whether or not usage for that claim is valid. For example, here is a project ID, resource name, and resource quantity, tell me if this project is over it's associated limit or default limit.<br>
><br>
> We're currently working on implementing the enforcement bits of oslo.limit, which requires making API calls to keystone in order to retrieve the deployed enforcement model, limit information, and project hierarchies. Then it needs to reason about those things and calculate usage from the service in order to determine if the request claim is valid or not. There are patches up for this work, and reviews are always welcome [4].<br>
><br>
> Note that we haven't released oslo.limit yet, but once the basic enforcement described above is implemented we will. Then services can officially pull it into their code as a dependency and we can work out remaining bugs in both keystone and oslo.limit. Once we're confident in both the API and the library, we'll bump oslo.limit to version 1.0 at the same time we graduate the unified limits API from "experimental" to "supported". Note that oslo libraries <1.0 are considered experimental, which fits nicely with the unified limit API being experimental as we shake out usability issues in both pieces of software.<br>
><br>
> # services<br>
><br>
> Finally, we'll be in a position to start integrating oslo.limit into services. I imagine this to be a coordinated effort between keystone, oslo, and service developers. I do have a patch up that adds a conceptual overview for developers consuming oslo.limit [5], which renders into [6].<br>
><br>
> To be honest, this is going to be a very large piece of work and it's going to require a lot of communication. In my opinion, I think we can use the first couple iterations to generate some well-written usage documentation. Any questions coming from developers in this phase should probably be answered in documentation if we want to enable folks to pick this up and run with it. Otherwise, I could see the handful of people pushing the effort becoming a bottle neck in adoption.<br>
><br>
> Hopefully this helps paint the landscape of where things are currently with respect to each piece. As always, let me know if you have any additional questions. If people want to discuss online, you can find me, and other contributors familiar with this topic, in #openstack-keystone or #openstack-dev on IRC (nic: lbragstad).<br>
><br>
> [0] <a href="http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/limits-api.html" rel="noreferrer" target="_blank">http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/limits-api.html</a><br>
> [1] <a href="https://etherpad.openstack.org/p/unified-limits-rocky-ptg" rel="noreferrer" target="_blank">https://etherpad.openstack.org/p/unified-limits-rocky-ptg</a><br>
> [2] <a href="https://tinyurl.com/y6ucarwm" rel="noreferrer" target="_blank">https://tinyurl.com/y6ucarwm</a><br>
> [3] <a href="http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/strict-two-level-enforcement-model.html" rel="noreferrer" target="_blank">http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/strict-two-level-enforcement-model.html</a><br>
> [4] <a href="https://review.openstack.org/#/q/project:openstack/oslo.limit+status:open" rel="noreferrer" target="_blank">https://review.openstack.org/#/q/project:openstack/oslo.limit+status:open</a><br>
> [5] <a href="https://review.openstack.org/#/c/600265/" rel="noreferrer" target="_blank">https://review.openstack.org/#/c/600265/</a><br>
> [6] <a href="http://logs.openstack.org/65/600265/3/check/openstack-tox-docs/a6bcf38/html/user/usage.html" rel="noreferrer" target="_blank">http://logs.openstack.org/65/600265/3/check/openstack-tox-docs/a6bcf38/html/user/usage.html</a><br>
><br>
> On Thu, Sep 6, 2018 at 8:56 PM Jaze Lee <<a href="mailto:jazeltq@gmail.com" target="_blank">jazeltq@gmail.com</a>> wrote:<br>
>><br>
>> Lance Bragstad <<a href="mailto:lbragstad@gmail.com" target="_blank">lbragstad@gmail.com</a>> 于2018年9月6日周四 下午10:01写道：<br>
>> ><br>
>> > I wish there was a better answer for this question, but currently there are only a handful of us working on the initiative. If you, or someone you know, is interested in getting involved, I'll happily help onboard people.<br>
>><br>
>> Well，I can recommend some my colleges to work on this. I wish in S,<br>
>> all service can use unified limits to do quota job.<br>
>><br>
>> ><br>
>> > On Wed, Sep 5, 2018 at 8:52 PM Jaze Lee <<a href="mailto:jazeltq@gmail.com" target="_blank">jazeltq@gmail.com</a>> wrote:<br>
>> >><br>
>> >> On Stein only one service?<br>
>> >> Is there some methods to move this more fast?<br>
>> >> Lance Bragstad <<a href="mailto:lbragstad@gmail.com" target="_blank">lbragstad@gmail.com</a>> 于2018年9月5日周三 下午9:29写道：<br>
>> >> ><br>
>> >> > Not yet. Keystone worked through a bunch of usability improvements with the unified limits API last release and created the oslo.limit library. We have a patch or two left to land in oslo.limit before projects can really start using unified limits [0].<br>
>> >> ><br>
>> >> > We're hoping to get this working with at least one resource in another service (nova, cinder, etc...) in Stein.<br>
>> >> ><br>
>> >> > [0] <a href="https://review.openstack.org/#/q/status:open+project:openstack/oslo.limit+branch:master+topic:limit_init" rel="noreferrer" target="_blank">https://review.openstack.org/#/q/status:open+project:openstack/oslo.limit+branch:master+topic:limit_init</a><br>
>> >> ><br>
>> >> > On Wed, Sep 5, 2018 at 5:20 AM Jaze Lee <<a href="mailto:jazeltq@gmail.com" target="_blank">jazeltq@gmail.com</a>> wrote:<br>
>> >> >><br>
>> >> >> Hello,<br>
>> >> >> Does nova and cinder use keystone's unified limits api to do quota job?<br>
>> >> >> If not, is there a plan to do this?<br>
>> >> >> Thanks a lot.<br>
>> >> >><br>
>> >> >> --<br>
>> >> >> 谦谦君子<br>
>> >> >><br>
>> >> >> __________________________________________________________________________<br>
>> >> >> OpenStack Development Mailing List (not for usage questions)<br>
>> >> >> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> >> >> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>> >> ><br>
>> >> > __________________________________________________________________________<br>
>> >> > OpenStack Development Mailing List (not for usage questions)<br>
>> >> > Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> >> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>> >><br>
>> >><br>
>> >><br>
>> >> --<br>
>> >> 谦谦君子<br>
>> >><br>
>> >> __________________________________________________________________________<br>
>> >> OpenStack Development Mailing List (not for usage questions)<br>
>> >> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> >> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>> ><br>
>> > __________________________________________________________________________<br>
>> > OpenStack Development Mailing List (not for usage questions)<br>
>> > Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>><br>
>><br>
>><br>
>> --<br>
>> 谦谦君子<br>
>><br>
>> __________________________________________________________________________<br>
>> OpenStack Development Mailing List (not for usage questions)<br>
>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
<br>
<br>
-- <br>
谦谦君子<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote></div>