CLI and automation¶

The dashboard is convenient for one-off tasks, but most day-to-day and automated work happens through the openstack command-line client and infrastructure-as-code tools.

Install the client¶

The OpenStack client is a Python package:

pip install python-openstackclient

Most Linux distributions also package it as python3-openstackclient.

Authenticate¶

Download a clouds.yaml file from the dashboard under Identity → Application Credentials (see Authentication) and place it at ~/.config/openstack/clouds.yaml. Then select the cloud:

export OS_CLOUD=my-cloud
openstack server list

Application credentials are the recommended way to authenticate automation. They are scoped to a single project, can be given a limited role, and can be revoked independently without touching your own account password.

Identity endpoint¶

If a tool asks for the authentication URL directly, the Keystone identity endpoint is:

https://identity.sunetvdc.se

Terraform and OpenTofu¶

For declarative, repeatable infrastructure, use the OpenStack provider with Terraform or OpenTofu. The provider reads the same clouds.yaml:

terraform {
  required_providers {
    openstack = {
      source = "terraform-provider-openstack/openstack"
    }
  }
}

provider "openstack" {
  cloud = "my-cloud"
}

resource "openstack_compute_instance_v2" "web" {
  name        = "web"
  flavor_name = "b2.c2r4"
  key_pair    = "mykey"
  image_name  = "Debian 13"

  network {
    name = "my-project-net"
  }
}

Orchestration with Heat¶

OpenStack also has its own orchestration service, Heat, reachable at https://orchestration.orion.sunetvdc.se. You can describe a stack of resources in a Heat template and create or update it with openstack stack create. Terraform or OpenTofu are usually the simpler choice unless you specifically want native OpenStack templates.