3

By default, a tenant (1) can only create 10 security groups (2). Is there any reason to keep this number so low?

(1) http://docs.openstack.org/grizzly/openstack-compute/admin/content//users-and-projects.html:

Legacy terminology: earlier versions of OpenStack used the term "project" instead of "tenant".

(2) http://docs.openstack.org/user-guide-admin/content/cli_set_quotas.html:

$ nova quota-defaults
+-----------------------------+-------+
| Quota                       | Limit |
+-----------------------------+-------+
| instances                   | 10    |
| cores                       | 20    |
| ram                         | 51200 |
| floating_ips                | 10    |
| fixed_ips                   | -1    |
| metadata_items              | 128   |
| injected_files              | 5     |
| injected_file_content_bytes | 10240 |
| injected_file_path_bytes    | 255   |
| key_pairs                   | 100   |
| security_groups             | 10    |
| security_group_rules        | 20    |
+-----------------------------+-------+
2

The most obvious effect is to keep firewall rules to a manageable level, which does not have a significant impact on performance. At a certain point, you may end up with too many firewall rules and not enough CPU to process them quickly enough. The default limits may seem low, but they're sufficient for most people, who will never create more than a few security groups with perhaps half a dozen rules each.

  • 1
    Although the impact on firewall rules is actually limited by the security_group_rules quota, not the security_group quota. The purpose of the quota on groups seems to be to have a meaningless display in the Horizon GUI - for some reason the quota on rules is not displayed there, and I only discovered that there was a separate quota on rules when I went searching for the reason I got a generic and unhelpful "Error: Unable to add rule to security group." failure and ended up here. I had already increased the quota on groups to a value higher than the quota on rules! – Alex Dupuy Mar 23 '15 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.