[glance] Comprehensive v2 API rate limiting (fix action keys + watcher normalization)

openstack/glance/Chart.yaml

@@ -4,7 +4,7 @@ appVersion: flamingo
 description: A Helm chart Openstack Glance
 icon: https://www.openstack.org/themes/openstack/images/project-mascots/Glance/OpenStack_Project_Glance_vertical.png
 name: glance
-version: 0.8.5
+version: 0.8.6
 dependencies:
   - condition: mariadb.enabled
     name: mariadb

openstack/glance/templates/etc/_ratelimit.yaml.tpl

@@ -22,8 +22,11 @@ groups:
     - delete
 
 rates:
-  # global rate limits counted across all projects
+  # ==========================================================================
+  # GLOBAL RATE LIMITS - counted across all projects
+  # ==========================================================================
   global:
+    # --- Images ---
     images:
       - action: read/list
         limit: 2000r/m
@@ -34,12 +37,208 @@ rates:
       - action: read
         limit: 2000r/m
 
-  # default local rate limits applied to each project
+    # --- Tasks ---
+    tasks:
+      - action: read/list
+        limit: 2000r/m
+
+    # --- Schemas (cacheable, high limit) ---
+    schemas:
+      - action: read
+        limit: 5000r/m
+
+    # --- Metadefs ---
+    metadefs/namespaces:
+      - action: read/list
+        limit: 2000r/m
+    metadefs/resource_types:
+      - action: read/list
+        limit: 2000r/m
+
+  # ==========================================================================
+  # DEFAULT LOCAL RATE LIMITS - applied to each project individually
+  # ==========================================================================
   default:
-    images/*:
+    # --- Images CRUD ---
+    images:
       - action: read
         limit: 600r/m
       - action: list
         limit: 600r/m
       - action: create
+        limit: 100r/m
+
+    images/image:
+      - action: read
         limit: 600r/m
+      - action: update
+        limit: 100r/m
+      - action: delete
+        limit: 100r/m
+
+    # --- Image File (upload/download) ---
+    images/image/file:
+      - action: read
+        limit: 300r/m
+      - action: update
+        limit: 50r/m
+
+    # --- Image Stage (for import workflow) ---
+    images/image/stage:
+      - action: update
+        limit: 50r/m
+
+    # --- Image Import ---
+    images/image/import:
+      - action: create
+        limit: 50r/m
+
+    # --- Image Actions (deactivate/reactivate) ---
+    images/image/actions:
+      - action: update
+        limit: 100r/m
+
+    # --- Image Members (sharing) ---
+    images/image/members:
+      - action: read
+        limit: 300r/m
+      - action: list
+        limit: 300r/m
+      - action: create
+        limit: 100r/m
+
+    images/image/members/member:
+      - action: read
+        limit: 300r/m
+      - action: update
+        limit: 100r/m
+      - action: delete
+        limit: 100r/m
+
+    # --- Image Tags ---
+    images/image/tags:
+      - action: update
+        limit: 200r/m
+      - action: delete
+        limit: 200r/m
+
+    # --- Image Locations ---
+    images/image/locations:
+      - action: read
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+
+    # --- Tasks ---
+    tasks:
+      - action: read
+        limit: 300r/m
+      - action: list
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+
+    tasks/task:
+      - action: read
+        limit: 300r/m
+      - action: delete
+        limit: 100r/m
+
+    # --- Schemas (read-only, generous limits) ---
+    schemas/*:
+      - action: read
+        limit: 1000r/m
+      - action: read/list
+        limit: 1000r/m
+
+    # --- Discovery/Info APIs ---
+    info/import:
+      - action: read
+        limit: 300r/m
+    info/stores:
+      - action: read/list
+        limit: 300r/m
+    info/usage:
+      - action: read
+        limit: 300r/m
+
+    # --- Metadef Namespaces ---
+    metadefs/namespaces:
+      - action: read/list
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+
+    metadefs/namespaces/namespace:
+      - action: read
+        limit: 300r/m
+      - action: update
+        limit: 50r/m
+      - action: delete
+        limit: 50r/m
+
+    # --- Metadef Properties ---
+    metadefs/namespaces/namespace/properties:
+      - action: read
+        limit: 300r/m
+      - action: read/list
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+      - action: delete
+        limit: 50r/m
+
+    # --- Metadef Objects ---
+    metadefs/namespaces/namespace/objects:
+      - action: read
+        limit: 300r/m
+      - action: read/list
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+      - action: delete
+        limit: 50r/m
+
+    # --- Metadef Tags ---
+    metadefs/namespaces/namespace/tags:
+      - action: read/list
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+      - action: delete
+        limit: 50r/m
+
+    # --- Metadef Resource Types ---
+    metadefs/resource_types:
+      - action: read
+        limit: 300r/m
+      - action: read/list
+        limit: 300r/m
+
+    metadefs/namespaces/namespace/resource_types:
+      - action: read
+        limit: 300r/m
+      - action: read/list
+        limit: 300r/m
+      - action: create
+        limit: 50r/m
+      - action: delete
+        limit: 50r/m
+
+    # --- Cache Management (admin only) ---
+    cache:
+      - action: read
+        limit: 100r/m
+      - action: delete
+        limit: 10r/m
+    cache/image:
+      - action: update
+        limit: 50r/m
+      - action: delete
+        limit: 50r/m
+
+    # --- Stores (multi-store) ---
+    stores/store/image:
+      - action: delete
+        limit: 50r/m
+

openstack/glance/templates/etc/_watcher.yaml.tpl

@@ -1,6 +1,7 @@
 path_keywords:
   - images
   - members
+  - namespaces
   - schemas
   - stores
   - tags