Description of problem: When exceed openshift.io/imagestreams resourcequota still could create imagestreams on project Version-Release number of selected component (if applicable): openshift version openshift v1.3.0-alpha.3+f237d09 kubernetes v1.3.0+507d3a7 etcd 2.3.0+git How reproducible: Always Steps to Reproduce: 1. Create resourcequota on project; apiVersion: v1 kind: ResourceQuota metadata: name: openshift-object-counts spec: hard: openshift.io/imagestreams: "1" 2. Create imagestreams exceed the openshift.io/imagestreams resourcequota `oc tag busybox mybox:v1` `oc tag openshift/hello-openshift myis2:v2` Actual results: 2. Could create the second imagestream: [root@dhcp-128-40 workdir]# oc get is NAME DOCKER REPO TAGS UPDATED mybox 172.30.119.240:5000/zhouy/mybox v1 4 minutes ago myis2 172.30.119.240:5000/zhouy/myis2 v2 4 minutes ago [root@dhcp-128-40 workdir]# oc describe quota openshift-object-counts Name: openshift-object-counts Namespace: zhouy Resource Used Hard -------- ---- ---- openshift.io/imagestreams 2 1 Expected results: 2. Should ban to create the second imagestream. Additional info:
I am working on to reproduce the issue on my local setup.
(In reply to Avesh Agarwal from comment #1) > I am working on to reproduce the issue on my local setup. I reproduced this locally, but I doubt this is a regression because we introduced limits in 3.2 and I'm not sure they ever worked for `oc tag`.
I agree Michal, if they were not functional before, then it does not sound regression.
I think a couple changes were introduced that caused this to regress. Fixed in https://github.com/openshift/origin/pull/10517 1. We started handling updates differently in quota admission 2. istag now has a create verb and the evaluator didn't handle it.
Confirmed with ami:devenv-rhel7_4874 , the issue has fixed. [root@ip-172-18-14-199 amd64]# oc describe quota openshift-object-counts Name: openshift-object-counts Namespace: zhouy Resource Used Hard -------- ---- ---- openshift.io/imagestreams 0 1 [root@ip-172-18-14-199 amd64]# oc tag busybox mybox:v1 Tag mybox:v1 set to busybox. [root@ip-172-18-14-199 amd64]# oc tag openshift/hello-openshift myis2:v2 Error from server: imagestreams "myis2" is forbidden: Exceeded quota: openshift-object-counts, requested: openshift.io/imagestreams=1, used: openshift.io/imagestreams=1, limited: openshift.io/imagestreams=1 Please modify the status to ON_QA, thanks.