Skip to content

Guide: CLI and API access

Everything you can do in the web interface can also be done via the command line using the openstack CLI utility. In Fedora and Ubuntu, the package name is "python3-openstackclient".

To use this, you need a token - the old OpenStack RC file method will not work since it does not support 2FA. You need to make one token (application credential) per project you want to work with.

Go to Identity > Application Credentials. Click + Create Application Credential.

  • Give it a Name, e.g., the name of the workstation where you will use it. If you have access to many projects, it is a good idea to include the project name in the application credential name.
  • Enter a Secret password which is strong but possible to remember, or leave it open to let OpenStack generate a random password for you.
  • Roles should contain both member (allowed to do stuff) and reader (allowed to look at stuff). Select the roles you need. If no roles are selected (blue background in default theme), all roles will be included.

Known bug: If you use a double quote in your password, it will be replaced by " in the downloaded file. Intermittent error: If you get Error: Unable to create application credential, try to sign out and sign back in.

Please note

If you want to integrate with the infrastructure cloud in an application, you probably want a service account. Contact support to get one setup. That way, you do not have to re-authenticate to the web-interface to ensure that the CLI/API functions.

openrc

If you choose Download openrc file you get a file intended to be sourced in your shell.

The file will contain both the token and your secret password in plain text, so make sure you do not store it or back it up to unencrypted storage! You can remove the secret password from the file and type it when you source the file instead, which is recommended. See https://gitlab.redpill-linpro.com/kjetilho/osinit for one way to manage such files.

After the openrc file has been sourced, you run openstack commands with an implied project for your commands.

: 23:46:37 (kjetilho) [kjetilho@scribus ~]; openstack server list
+--------------------------------------+----------------+--------+---------------------------------------+--------------------------+-------------+
| ID                                   | Name           | Status | Networks                              | Image                    | Flavor      |
+--------------------------------------+----------------+--------+---------------------------------------+--------------------------+-------------+
| 30f50628-10e7-452d-a297-85467024a8fd | minnie.njus.no | ACTIVE | internal=192.168.4.198, 87.238.54.121 | N/A (booted from volume) | labs.medium |
+--------------------------------------+----------------+--------+---------------------------------------+--------------------------+-------------+
Intermittent error: If you after a while get The request you have made requires authentication. (HTTP 401), try to sign out and sign back in in the web-ui.

clouds.yaml

The file must contain both the token and your secret password in plain text, so make sure you do not store it or back it up to unencrypted storage!

The clouds-NAME.yaml file you get will need to be merged with your existing clouds.yaml file to be useful.

Basically, the yaml file contains a single hash, named clouds, with multiple named identities. The downloaded file will have a single identity with the generic name openstack, which you can/should replace with the project name when you paste it into your consolidated ~/.config/openstack/clouds.yaml.

You then choose identity by specifying --os-cloud=PROJECT with every openstack command.

: 23:57:40 [kjetilho@scribus ~]; openstack --os-cloud=kjetilho server list
+--------------------------------------+----------------+--------+---------------------------------------+--------------------------+-------------+
| ID                                   | Name           | Status | Networks                              | Image                    | Flavor      |
+--------------------------------------+----------------+--------+---------------------------------------+--------------------------+-------------+
| 30f50628-10e7-452d-a297-85467024a8fd | minnie.njus.no | ACTIVE | internal=192.168.4.198, 87.238.54.121 | N/A (booted from volume) | labs.medium |
+--------------------------------------+----------------+--------+---------------------------------------+--------------------------+-------------+

clouds.yaml in project root

You can also let clouds.yaml reside inside your current project path. As long as a file called clouds.yaml is in the root of your project, openstack CLI will detect this and use it. NB! you need to make sure that you then export OS_CLOUD=openstack as openstack is the default name given to clouds when you download the configuration file from the OpenStack GUI.

Many OpenStack utilities conform to this convention, including Terraform/OpenTofu. As long as the clouds.yaml file is in the root of the project, you are good to go.