Programmatic Access and Automation

In a Nutshell

Application Credentials enable secure, token-based access to bwCloud-OS — ideal for CLI usage and automation. You can use these credentials with the OpenStack CLI to manage cloud resources from the command line. You can also use the credentials with the OpenStack Python SDK to manage cloud resources programmatically from within Python scripts or applications. Automation tools like Ansible or Terraform can be used for efficient deployment and configuration of instances.

Application Credentials

How can I create an application credential?

Application Credentials (also called tokens) allow access to your OpenStack project in an automated or script-based way — without requiring a password. To create one, you must have the necessary member privileges in the target project.

Steps to Create an Application Credential

1. Log in to the Dashboard and select the correct region.
2. Go to Identity → Application Credentials and click Create Application Credential.
3. In the form that opens, fill out:
   • Name – a descriptive name for the credential.
   • Secret – choose a secure secret (password-like).
   • Expiration – set an (optional) expiration date.
4. At the bottom of the form, click Create Application Credential.
5. Download the OpenRC file and save it, for example as my_token.sh. Alternatively, you can download the file clouds.yaml.

Make sure to protect your secret — store it securely and do not share it.

📌 Note: The login-based method (via the top-right menu in the Dashboard) requires a password, which is not enabled by default in bwCloud-OS.

Using the OpenRC file (Recommended for CLI Usage)

Source your credential file my_token.sh:

source my_token.sh

The following command (see OpenStack CLI) will display the active cloud configuration, including the application credentials:

openstack configuration show

Optional: Ask for the Secret at Runtime

For added security, you can modify your my_token.sh file so that the secret is not stored in plain text within the file. Replace the line:

export OS_APPLICATION_CREDENTIAL_SECRET=********************

with:

echo "Passphrase: "
read -sr os_credential_secret_input
export OS_APPLICATION_CREDENTIAL_SECRET="$os_credential_secret_input"

This way, you will be prompted for the secret each time you use the credential file.

Using the clouds.yaml file (Recommended for Automation)

A clouds.yaml file provides a convenient way to configure access to OpenStack without exporting many environment variables.

Example clouds.yaml

clouds:
  openstack:
    auth:
      auth_url: https://your-auth-url:5000
      application_credential_id: "YOUR_ID"
      application_credential_secret: "YOUR_SECRET"
    region_name: "RegionOne"
    interface: "public"
    identity_api_version: 3
    auth_type: "v3applicationcredential"

Loading and Testing the Configuration

If this is your only cloud, you can place the file at one of the default locations:

• ~/.config/openstack/clouds.yaml
• /etc/openstack/clouds.yaml

OpenStack CLI tools will automatically detect the file there.

If your file is stored in a custom location, you can specify it explicitly:

export OS_CLIENT_CONFIG_FILE=/path/to/clouds.yaml

In multi-cloud setups, you can define multiple entries and select one by specifying the cloud name, e.g.:

export OS_CLOUD=openstack

Once the above configuration is set, the following command (see OpenStack CLI) will display the active cloud configuration, including the application credentials:

openstack configuration show

OpenStack CLI

How can I connect to the bwCloud-OS using the OpenStack CLI?

To manage your resources from the command line, you can use the OpenStack Client (openstack command-line tool, implemented in Python).

Installation of the client depends on your operating system, e.g. for Ubuntu (for other installation methods, see the guide OpenStack CLI):

sudo apt install python3-openstackclient 

Authentication Methods

See the section Create an application credential.

Testing the Connection

Run the following commands in a terminal:

source ./my_token.sh
openstack token issue

This will issue a new authentication token, confirming that your configuration works correctly.

How can I perform basic operations with the OpenStack CLI?

For common tasks such as managing instances, volumes, and networks, see: Guide: OpenStack CLI – Basic Usage.

OpenStack Python SDK

How can I connect to the bwCloud-OS using the OpenStack Python SDK?

To manage your resources from within Python scripts, you can use the OpenStack Python SDK.

Installation depends on your operating system, e.g. for Ubuntu (for other installation methods, see the guide OpenStack Python SDK):

sudo apt install python3-openstacksdk 

Authentication Methods

See the section Create an application credential.

For this purpose, we recommend using the clouds.yaml file.

Testing the Connection

Start a Python shell and run:

import openstack
conn = openstack.connect(cloud="openstack")
conn.authorize()
token = conn.session.get_token()
print("Token:", token)

This will issue a new authentication token, confirming that your configuration works correctly.

How can I perform basic operations with the OpenStack SDK?

For common tasks such as managing instances, volumes, and networks, see: Guide: OpenStack Python SDK – Basic Usage.

Auto-Deployment

The following tools are commonly used for (semi-)automated provisioning of resources.

Method	Usage
Terraform	This tool can be used to create an instance or a defined infrastructure.
Ansible	Create roles or tasks for all customizations that you make in an instance.

Does bwCloud-OS provide templates for automated deployment of OpenStack instances?

Yes. You can use this Ansible template to get started more easily.