From 6f2b50bef258b35d6913b492ff1861defd630e98 Mon Sep 17 00:00:00 2001
From: Scot Wells <wells.scot@gmail.com>
Date: Thu, 24 Sep 2026 20:01:24 -0500
Subject: [PATCH] fix: Raise the IPAM quota defaults past what retention
 accrues

A fabric identity is claimed once per network and retained forever, because
reissuing one would merge a new network into a dead one's routes. A project's
claim count therefore only rises, and the platform project holding the tenant
address pools carries a claim for every network in the environment rather than
its own.

The old default of 100 was sized for a project's own claims. Production reached
65 of it in seven days at a trailing rate of 21 a day, and reaching 100 fails
every address allocation for every tenant, not just the project that crossed
the line.

Key changes:
- Raise the IPClaim default to 10000 and the IPPool default to 2500
- Raise both ceilings so an operator can still grant above the default
- Record why the count only rises, so the next person sizing this knows
---
 .../service-catalog/serviceconfiguration.yaml    | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/config/components/service-catalog/serviceconfiguration.yaml b/config/components/service-catalog/serviceconfiguration.yaml
index c60bf36..1f98e10 100644
--- a/config/components/service-catalog/serviceconfiguration.yaml
+++ b/config/components/service-catalog/serviceconfiguration.yaml
@@ -24,22 +24,30 @@ spec:
       unit: "1"
   quota:
     limits:
+      # A fabric identity is claimed per network and retained forever, because
+      # reissuing one would merge a new network into a dead one's routes. So a
+      # project's claim count only ever rises, and the platform project that
+      # holds the tenant address pools carries a claim for every network in the
+      # environment rather than its own. A limit sized for one project's own
+      # claims is reached in days there, and reaching it fails every address
+      # allocation for every tenant.
       - name: ipclaims-per-project
         metric: ipam.miloapis.com/ipclaims
         consumerType:
           apiGroup: resourcemanager.miloapis.com
           kind: Project
         unit: "1/{project}"
-        defaultLimit: 100
-        maxLimit: 10000
+        defaultLimit: 10000
+        maxLimit: 1000000
+      # Pools accrue the same way, one per network per location.
       - name: ippools-per-project
         metric: ipam.miloapis.com/ippools
         consumerType:
           apiGroup: resourcemanager.miloapis.com
           kind: Project
         unit: "1/{project}"
-        defaultLimit: 25
-        maxLimit: 1000
+        defaultLimit: 2500
+        maxLimit: 250000
     metricRules:
       - selector:
           apiGroup: ipam.miloapis.com