Openstack API clients commonly use a set of environment variables such as OS_AUTH_TYPE, OS_AUTH_URL, etc.

The set of needed variables can be downloaded from the dashboard as an Openstack RC File (v2.0 or v3). This is basically a shell script that you need to source in the current session:

app-cred-test-openrc.sh
#!/usr/bin/env bash
  
export OS_AUTH_TYPE=v3applicationcredential
export OS_AUTH_URL=https://keystone.cloud.garr.it:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_REGION_NAME="garr-ct1"
export OS_INTERFACE=public
export OS_APPLICATION_CREDENTIAL_ID=33ff72a9162341dbb81fd480ddcc23d7
export OS_APPLICATION_CREDENTIAL_SECRET=HACKME


With the environment vars available, tools like OpenStackClient work, or the Openstack Ansible modules.

The problem is how to store these sensitive credentials.

Ansible provides ansible-vault to encrypt information - an example Ansible playbook might look like this:


---
- hosts: localhost
  vars_files: vault.yml
  environment: "{{ openrc_vars }}"


  tasks:
    - os_keypair:
        state: present
        name: my_key
        public_key_file: .ssh/id_rsa.pub

with the encrypted vault.yml file containing:


---
openrc_vars:
  OS_AUTH_TYPE: v3applicationcredential
  OS_AUTH_URL: https://keystone.cloud.garrservices.it:5000/v3
  OS_IDENTITY_API_VERSION: 3
  OS_REGION_NAME: garr-pa1
  OS_INTERFACE: public
  OS_APPLICATION_CREDENTIAL_ID: 33ff72a9162341dbb81fd480ddcc23d7
  OS_APPLICATION_CREDENTIAL_SECRET: HACKME




These encrypted variables can conveniently be reused for command line usage, by defining an alias in your BASH configuration file (.bashrc or .bash_profile). It requires the jq binary:


# Alias to populate Openstack environment variables from ansible vault encrypted file
alias openstack-auth='$(ANSIBLE_LOAD_CALLBACK_PLUGINS=TRUE ANSIBLE_STDOUT_CALLBACK=json ansible all -m debug -i localhost, --extra-vars "@vault.yml" -a "msg=\"{% for k,v in openrc_vars.items() %}export {{ k }}={{ v }}\n{% endfor %}\"" | jq -r '\''.["plays"][0]["tasks"][0]["hosts"]["localhost"]["msg"]'\'')'





0 Comments