## Overview Implement a quota management system to limit the total number of SecurityProjectTrackedContexts in the `tracked` state per organization on GitLab.com. This mitigates the risk of overallocating vulnerability management capability. ## Closed Beta Requirements **Critical constraints:** 1. **Default quota of 2** for all VAC-enabled namespaces (conservative starting point) 2. **Fine-grained control** per namespace to increase quota for specific customers 3. **No disruption** to non-VAC namespaces (quota only applies when feature flag enabled) 4. **Easy adjustment** via Admin API/UI for rapid response during rollout **Rollout progression:** - **Closed Beta:** Default = 2, manually increase for trusted customers - **Open Beta:** Default = calculated (e.g., projects × 2), manual overrides preserved - **GA:** Default = generous calculated value, quota increase request process in place ## Implementation Plan ### Phase 1: Foundation (P0 - Closed Beta MVP) | # | Issue | Description | Status | |---|-------|-------------|--------| | 1 | #585969 | Add quota columns to database (namespace_settings + application_settings) | 🔲 | | 2 | #598087 | Implement quota enforcement service (`TrackedContextQuotaService`) | 🔲 | | 3 | #598088 | Update ProjectTrackedContext validation to enforce org quota | 🔲 | | 4 | #585971 | Implement API endpoint to query organization quota | 🔲 | | 5 | #585972 | Implement API endpoint to update organization quota | 🔲 | ### Phase 2: Admin Interface (P1) | # | Issue | Description | Status | |---|-------|-------------|--------| | 6 | #585970 | Create Admin Area UI for quota management | 🔲 | ### Phase 3: User Experience & Operations (P2 - Before GA) | # | Issue | Description | Status | |---|-------|-------------|--------| | 7 | #585973 | Update security context configuration page to display quota usage | 🔲 | | 8 | #556012 | Backfill quotas for existing namespaces (GA preparation) | 🔲 | | 9 | #585974 | Define Customer Support process for quota increase requests | 🔲 | ## Quick Reference: Closed Beta Operations **View a customer's quota (GraphQL):** ```graphql query { namespace(fullPath: "customer-org") { securityTrackedContextQuota { limit usage remaining explicitlySet } } } ``` **Increase a customer's quota (GraphQL):** ```graphql mutation { securityUpdateTrackedContextQuota( input: { namespaceId: "gid://gitlab/Group/12345", quota: 10 } ) { quotaInfo { limit usage } errors } } ``` **Rails console (emergency):** ```ruby ns = Namespace.find_by_full_path('customer-org') ns.namespace_settings.update!(security_tracked_context_quota: 10) ``` **Check/update global default:** ```ruby Gitlab::CurrentSettings.default_security_tracked_context_quota # => 2 ApplicationSetting.current.update!(default_security_tracked_context_quota: 5) ``` ## Success Criteria - [ ] Organizations have a defined quota limit for tracked contexts (default: 2) - [ ] Administrators can view and update quotas via Admin Area or API - [ ] Users see clear error when quota is exceeded - [ ] Quota only enforced for VAC-enabled namespaces - [ ] Customer Support has documented process for quota increase requests ## Related - Parent Epic: &3430 (Track Vulnerabilities Across Contexts) - Implementation Plan: `.opencode/gitlab-org/gitlab/epics/20475-quota-implementation-plan.md`