Quotas exist in Designate for various resources. You can configure
quotas globally or on a per-project basis.

Viewing Quotas

The Designate
plugin for the OpenStack
Client allows users to query their current quota using the
dns quota list command.

$ openstack dns quota list
+-------------------+-------+
| Field             | Value |
+-------------------+-------+
| api_export_size   | 1000  |
| recordset_records | 20    |
| zone_records      | 500   |
| zone_recordsets   | 500   |
| zones             | 10    |
+-------------------+-------+

Users can also view their quotas with a simple View
Current Project’s Quotas Designate API call:

GET /v2/quotas/ HTTP/1.1
Accept: application/json
Content-Type: application/json

Response:

HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
X-Openstack-Request-Id: req-bfcd0723-624c-4ec2-bbd5-99e985efe8db

{
  "api_export_size": 1000,
  "recordset_records": 20,
  "zone_records": 500,
  "zone_recordsets": 500,
  "zones": 10
}

Administrators with a cross-project read role can query the quotas
for other projects using the --project-id option to the
dns quota list command or by specifying a project_id when
making the View Quotas
Designate API call.

$ openstack dns quota list --project-id ecd4341280d645e5959d32a4b7659da1
+-------------------+-------+
| Field             | Value |
+-------------------+-------+
| api_export_size   | 1000  |
| recordset_records | 20    |
| zone_records      | 500   |
| zone_recordsets   | 500   |
| zones             | 20    |
+-------------------+-------+

GET /v2/quotas/ecd4341280d645e5959d32a4b7659da1 HTTP/1.1
Accept: application/json
Content-Type: application/json

Modifying Quotas

You can edit Designate quotas on a per-project basis. An
administrator can edit quotas for any project, but they must have an
all_tenants role or use a system scoped
admin token.

Administrators can set a custom quota for a project using the OpenStack
Client dns quota set command.

$ openstack dns quota set --project-id ecd4341280d645e5959d32a4b7659da1 --zones 30
+-------------------+-------+
| Field             | Value |
+-------------------+-------+
| api_export_size   | 1000  |
| recordset_records | 20    |
| zone_records      | 500   |
| zone_recordsets   | 500   |
| zones             | 30    |
+-------------------+-------+

Below is an example of setting a quota using the Set Quotas
Designate API.

PATCH /v2/quotas/ecd4341280d645e5959d32a4b7659da1 HTTP/1.1
Accept: application/json
Content-Type: application/json
X-Auth-All-Projects: True

{
  "zones": 30
}

The response would be:

HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
X-Openstack-Request-Id: req-ee264c7d-d9f3-4de8-92ec-7de4dc93a255

{
  "api_export_size": 1000,
  "recordset_records": 20,
  "zone_records": 500,
  "zone_recordsets": 500,
  "zones": 30
}

Resetting Quotas

You can reset custom quotas for a project to their default values by
using the dns quota reset command. Administrators can reset
quotas for any project, but they must have an all_tenants role or use a system scoped admin
token.

$ openstack dns quota reset --project-id ecd4341280d645e5959d32a4b7659da1

Below is an example of resetting a project’s quota via the Reset Quota
Designate API.

DELETE /v2/quotas/ecd4341280d645e5959d32a4b7659da1 HTTP/1.1
Accept: application/json
Content-Type: application/json
X-Auth-All-Projects: True

The response would be:

HTTP/1.1 204 No Content
X-Openstack-Request-Id: req-82b85853-145d-4253-be86-b9aa3116b975

Available Quotas

The quotas available in Designate are listed below with a short
description and the default values.

Zones

Recordsets/Records

Zone Exports

Default Quotas

You can set a default value for each quota that applies to all users
by editing the [DEFAULT] configuration section of the
designate.conf file, for example:

[DEFAULT]
########################
## General Configuration
########################
quota_zones = 10
quota_zone_recordsets = 500
quota_zone_records = 500
quota_recordset_records = 20
quota_api_export_size = 1000

Project ID Verification

Although Designate API can accept arbitrary strings as the Project ID
to set the quota for, actual enforcement of quota will be performed only
when the project ID of the quota matches the project-id in
the request that attempts to create a resource.

To prevent mistakes when specifying the project-id for a
quota, you can turn on project ID verification in the Designate
configuration file:

[service:api]
quotas_verify_project_id = True

You must also specify how Designate connects to Keystone and locates
the appropriate Keystone endpoint with which to perform requests. In the
[keystone] section, ensure that the Session- and
Adapter-related options are set.

Here is an example:

[keystone]
cafile = /path/to/ca/bundle
valid_interfaces = internal,public
region_name = RegionWest

See keystoneauth
documentation for more details.

With project ID verification enabled, Designate will use the
credentials provided with the request to attempt to verify that the
project ID is valid in Keystone.

As a result of this verification, the request might return additional
errors in these cases:

• when the Keystone V3 endpoint could not be found in the service
  catalog (as specified in [keystone] section) –
  504 error is returned
• when the authentication with incoming token was successful but the
  project id was not actually found – 400 is returned

For project ID validation to be successful, the user setting quotas
should have permission to list projects in Keystone. If the user does
not have permission to list projects in Keystone, the validation will be
skipped.