Chapter 6. Viewing and managing quotas on DNS resources
Red Hat OpenStack Services on OpenShift (RHOSO) provides a set of DNS resource quotas that cloud administrators can modify using the DNS service (designate).
Using DNS quotas can help you to secure your RHOSO site from events such as denial-of-service attacks, by setting a limit on projects' DNS resources. Using DNS quotas can also help you to track your users' DNS resource consumption. Cloud administrators can set DNS quota values that apply to all projects, or configure one or more quotas on a project-by-project basis.
6.1. Viewing quotas for DNS resources Copy linkLink copied to clipboard!
You can view resource quotas for Red Hat OpenStack Services on OpenShift (RHOSO) projects by using the DNS service (designate).
Prerequisites
-
The administrator has created a project for you and has provided you with a
clouds.yamlfile for you to access the cloud. The
python-openstackclientpackage is on your workstation.$ dnf list installed python-openstackclient- You must be a member of the project whose quotas you want to view.
-
A RHOSO user with the
adminrole can view quotas for any project.
Procedure
Confirm that the system
OS_CLOUDvariable is set for your cloud:$ echo $OS_CLOUD my_cloudReset the variable if necessary:
$ export OS_CLOUD=my_other_cloudAs an alternative, you can specify the cloud name by adding the
--os-cloud <cloud_name>option each time you run anopenstackcommand.View the DNS resource quotas set for your project:
$ openstack dns quota list- Sample output
+-------------------+-------+ | Field | Value | +-------------------+-------+ | api_export_size | 1000 | | recordset_records | 20 | | zone_records | 500 | | zone_recordsets | 500 | | zones | 10 | +-------------------+-------+
A RHOSO user with the
adminrole can query the quotas for other projects:Obtain the ID for the project whose quotas you want to modify.
Remember the ID, because you need it for a later step.
$ openstack project listUsing the project ID, view the DNS resource quotas set for the project.
- Example
In this example, the DNS quotas for project ID
ecd4341280d645e5959d32a4b7659da1are displayed:$ openstack dns quota list --project-id ecd4341280d645e5959d32a4b7659da1- Sample output
+-------------------+-------+ | Field | Value | +-------------------+-------+ | api_export_size | 2500 | | recordset_records | 25 | | zone_records | 750 | | zone_recordsets | 750 | | zones | 25 | +-------------------+-------+
6.2. Modifying quotas for DNS resources Copy linkLink copied to clipboard!
You can change DNS resource quotas for Red Hat OpenStack Services on OpenShift (RHOSO) projects by using the DNS service (designate).
Prerequisites
-
You have the
occommand line tool installed on your workstation. -
You are logged on to a workstation that has access to the RHOSO control plane as a user with
cluster-adminprivileges.
Procedure
Access the remote shell for the OpenStackClient pod from your workstation:
$ oc rsh -n openstack openstackclientObtain the ID for the project whose quotas you want to modify.
Remember the ID, because you need it for a later step.
$ openstack project listUsing the project ID, modify a DNS resource quota for a project. For a list of available quotas, see Section 6.4, “DNS service quotas and their default values”.
- Example
In this example, the
zonesquota has been modified. The total number of zones that project IDecd4341280d645e5959d32a4b7659da1can contain is 30:$ openstack dns quota set --project-id ecd4341280d645e5959d32a4b7659da1 --zones 30- Sample output
+-------------------+-------+ | Field | Value | +-------------------+-------+ | api_export_size | 1000 | | recordset_records | 20 | | zone_records | 500 | | zone_recordsets | 500 | | zones | 30 | +-------------------+-------+
6.3. Resetting DNS resource quotas to their default values Copy linkLink copied to clipboard!
You can reset DNS resource quotas for Red Hat OpenStack Services on OpenShift (RHOSO) projects to their default values by using the DNS service (designate).
Prerequisites
-
You have the
occommand line tool installed on your workstation. -
You are logged on to a workstation that has access to the RHOSO control plane as a user with
cluster-adminprivileges.
Procedure
Access the remote shell for the OpenStackClient pod from your workstation:
$ oc rsh -n openstack openstackclientObtain the ID for the project whose quotas you want to reset.
Remember the ID, because you need it for a later step.
$ openstack project listUsing the project ID, reset the DNS resource quotas for a project.
- Example
In this example, the quotas for a project whose ID is
ecd4341280d645e5959d32a4b7659da1are being reset to the default values:$ openstack dns quota reset \ --project-id ecd4341280d645e5959d32a4b7659da1There is no output from a successful
openstack dns quota resetcommand.
Verification
Confirm that the DNS resource quotas for the project have been reset:
- Example
$ openstack dns quota list --project-id ecd4341280d645e5959d32a4b7659da1- Sample output
+-------------------+-------+ | Field | Value | +-------------------+-------+ | api_export_size | 1000 | | recordset_records | 20 | | zone_records | 500 | | zone_recordsets | 500 | | zones | 10 | +-------------------+-------+
6.4. DNS service quotas and their default values Copy linkLink copied to clipboard!
The Red Hat OpenStack Services on OpenShift (RHOSO) DNS service (designate) has quotas that a cloud administrator can set to limit DNS resource consumption by cloud users in one or in all RHOSO projects.
| Quota | Default | Description |
|---|---|---|
|
| 10 | The number of zones allowed per project. |
| Quota | Default | Description |
|---|---|---|
|
| 500 | The number of record sets allowed per zone. |
|
| 500 | The number of records allowed per zone. |
|
| 20 | The number of records allowed per record set. |
| Quota | Default | Description |
|---|---|---|
|
| 1000 | The number of record sets allowed in a zone export. |