@@ -1493,6 +1493,7 @@ _oadm_registry()

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

     flags+=("--daemonset")

     flags+=("--dry-run")

+    flags+=("--enforce-quota")

     flags+=("--images=")

     flags+=("--labels=")

     flags+=("--latest-images")

@@ -4513,6 +4513,7 @@ _oc_adm_registry()

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

     flags+=("--daemonset")

     flags+=("--dry-run")

+    flags+=("--enforce-quota")

     flags+=("--images=")

     flags+=("--labels=")

     flags+=("--latest-images")

@@ -2069,6 +2069,7 @@ _openshift_admin_registry()

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

     flags+=("--daemonset")

     flags+=("--dry-run")

+    flags+=("--enforce-quota")

     flags+=("--images=")

     flags+=("--labels=")

     flags+=("--latest-images")

@@ -8100,6 +8101,7 @@ _openshift_cli_adm_registry()

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

     flags+=("--daemonset")

     flags+=("--dry-run")

+    flags+=("--enforce-quota")

     flags+=("--images=")

     flags+=("--labels=")

     flags+=("--latest-images")

@@ -18,3 +18,4 @@ middleware:

     - name: openshift

       options:

         pullthrough: true

+        enforcequota: false

@@ -83,6 +83,7 @@ type RegistryConfig struct {

 	Selector       string

 	ServiceAccount string

 	DaemonSet      bool

+	EnforceQuota   bool

 	ServingCertPath string

 	ServingKeyPath  string

@@ -121,6 +122,7 @@ func NewCmdRegistry(f *clientcmd.Factory, parentName, name string, out io.Writer

 		Volume:         "/registry",

 		ServiceAccount: "registry",

 		Replicas:       1,

+		EnforceQuota:   true,

 	}

 	cmd := &cobra.Command{

@@ -153,6 +155,7 @@ func NewCmdRegistry(f *clientcmd.Factory, parentName, name string, out io.Writer

 	cmd.Flags().StringVar(&cfg.ServingCertPath, "tls-certificate", cfg.ServingCertPath, "An optional path to a PEM encoded certificate (which may contain the private key) for serving over TLS")

 	cmd.Flags().StringVar(&cfg.ServingKeyPath, "tls-key", cfg.ServingKeyPath, "An optional path to a PEM encoded private key for serving over TLS")

 	cmd.Flags().BoolVar(&cfg.DaemonSet, "daemonset", cfg.DaemonSet, "Use a daemonset instead of a deployment config.")

+	cmd.Flags().BoolVar(&cfg.EnforceQuota, "enforce-quota", cfg.EnforceQuota, "If set, the registry will refuse to write blobs if they exceed quota limits")

 	// autocompletion hints

 	cmd.MarkFlagFilename("credentials", "kubeconfig")

@@ -303,6 +306,11 @@ func RunCmdRegistry(f *clientcmd.Factory, cmd *cobra.Command, out io.Writer, cfg

 	env := app.Environment{}

 	env.Add(secretEnv)

+	enforceQuota := "false"

+	if cfg.EnforceQuota {

+		enforceQuota = "true"

+	}

+	env["REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA"] = enforceQuota

 	healthzPort := defaultPort

 	if len(ports) > 0 {

 		healthzPort = ports[0].ContainerPort

@@ -13,6 +13,8 @@

 package server

 import (

+	"fmt"

+

 	"github.com/docker/distribution"

 	"github.com/docker/distribution/context"

@@ -21,6 +23,44 @@ import (

 	imageadmission "github.com/openshift/origin/pkg/image/admission"

 )

+// newQuotaEnforcingConfig creates a configuration for quotaRestrictedBlobStore.

+func newQuotaEnforcingConfig(ctx context.Context, enforceQuota string, options map[string]interface{}) *quotaEnforcingConfig {

+	buildOptionValues := func(optionName string, override string) []string {

+		optValues := []string{}

+		if value, ok := options[optionName]; ok {

+			var res string

+			switch v := value.(type) {

+			case string:

+				res = v

+			case bool:

+				res = fmt.Sprintf("%t", v)

+			default:

+				res = fmt.Sprintf("%v", v)

+			}

+			optValues = append(optValues, res)

+		}

+		optValues = append(optValues, override)

+		return optValues

+	}

+

+	enforce := false

+	for _, s := range buildOptionValues("enforcequota", enforceQuota) {

+		enforce = s == "true"

+	}

+	if !enforce {

+		context.GetLogger(ctx).Info("quota enforcement disabled")

+	}

+	return &quotaEnforcingConfig{

+		enforcementDisabled: !enforce,

+	}

+}

+

+// quotaEnforcingConfig holds configuration for quotaRestrictedBlobStore.

+type quotaEnforcingConfig struct {

+	// if set, disables quota enforcement

+	enforcementDisabled bool

+}

+

 // quotaRestrictedBlobStore wraps upstream blob store with a guard preventing big layers exceeding image quotas

 // from being saved.

 type quotaRestrictedBlobStore struct {

@@ -30,6 +30,11 @@ const (

 	// DockerRegistryURLEnvVar is a mandatory environment variable name specifying url of internal docker

 	// registry. All references to pushed images will be prefixed with its value.

 	DockerRegistryURLEnvVar = "DOCKER_REGISTRY_URL"

+

+	// EnforceQuotaEnvVar is a boolean environment variable that allows to turn quota enforcement on or off.

+	// By default, quota enforcement is off. It overrides openshift middleware configuration option.

+	// Recognized values are "true" and "false".

+	EnforceQuotaEnvVar = "REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA"

 )

 var (

@@ -42,6 +47,9 @@ var (

 	// insecureTransport is the transport pool that does not verify remote TLS certificates for use

 	// during pullthrough against registries marked as insecure.

 	insecureTransport http.RoundTripper

+	// quotaEnforcing contains shared caches of quota objects keyed by project name. Will be initialized

+	// only if the quota is enforced. See EnforceQuotaEnvVar.

+	quotaEnforcing *quotaEnforcingConfig

 )

 func init() {

@@ -59,6 +67,9 @@ func init() {

 			if err != nil {

 				return nil, err

 			}

+			if quotaEnforcing == nil {

+				quotaEnforcing = newQuotaEnforcingConfig(ctx, os.Getenv(EnforceQuotaEnvVar), options)

+			}

 			return newRepositoryWithClient(registryOSClient, kClient, kClient, ctx, repo, options)

 		},

 	)

@@ -152,10 +163,12 @@ func (r *repository) Blobs(ctx context.Context) distribution.BlobStore {

 	bs := r.Repository.Blobs(ctx)

-	bs = &quotaRestrictedBlobStore{

-		BlobStore: bs,

+	if quotaEnforcing != nil {

+		bs = &quotaRestrictedBlobStore{

+			BlobStore: bs,

-		repo: &repo,

+			repo: &repo,

+		}

 	}

 	if r.pullthrough {