What is OpenStack API Access?

OpenStack API Access lets tools that work with the OpenStack APIs manage the resources in your projects: the openstack CLI, Terraform with its OpenStack provider, and the OpenStack cloud controller manager (OCCM) and Cinder CSI driver in Kubernetes. These tools sign in with an application credential, which you create in the console under Identity & Access › OpenStack API access. The console and its REST API never need one.

Key featuresCopy Anchor Link

• Application credentials. Restricted credentials that expire and that belong to one project. Create one for yourself or for a service account. See Create an application credential.
• Profiles. A profile sets the Keystone roles of a credential. With Full access, a credential creates and manages resources. The form lists every profile and disables the ones that you can't choose. See Profiles.
• Ready-made files. After you create a credential, the console generates clouds.yaml, openrc.sh, cloud.conf, a Kubernetes Secret, and a Terraform main.tf in your browser. See Downloaded files.
• Two-factor confirmation. Creating or rotating a credential, and switching OpenStack API access on or off, need a code from your authenticator app from the last 5 minutes. See Step-up verification.
• Rotation with an overlap. Replace a credential with a new one, with a new ID and secret, while the old one keeps working for up to 168 hours. Or revoke a credential to delete it at once. See Rotate and revoke credentials.
• Organization switch. OpenStack API access is off until an owner of the subscription switches it on for the organization. See Turn OpenStack API access on or off.

How it worksCopy Anchor Link

Every member and service account that gets a credential has its own identity in OpenStack. Its OpenStack roles in a project follow its role in the console: the Owner and Contributor roles map to the Keystone role member, the Reader role maps to reader, and the Billing Operator role gets no API access. A credential never has more than these roles. When a change lowers its owner's OpenStack role in the project, for example from member to reader, or removes the owner's access, the credential is deleted.

A credential is a Keystone application credential with an expiry date, bound to one project. Its secret is shown once, when you create it. Tools use the credential to sign in to the cloud's public identity endpoint, and then call the OpenStack APIs of the project's region.

Resources that you create through the OpenStack APIs are the same resources that you see in the console. They appear in the project, count against the subscription's quota and the project's allocation, and are billed in the same way.

Use casesCopy Anchor Link

• Infrastructure as code. Manage networks, instances, and volumes with Terraform.
• CI/CD pipelines. Give each pipeline a service account credential that keeps working when people leave the team.
• Kubernetes on your instances. Let OCCM create load balancers for Services and Cinder CSI create volumes for persistent volume claims.
• Scripting. Run openstack CLI commands against a project.

BillingCopy Anchor Link

OpenStack API Access has no billing dimensions of its own. The resources that you create through the APIs are billed to the project's subscription like resources that you create in the console. See How billing works.

LimitsCopy Anchor Link

• A credential belongs to one project.
• Each owner can have up to 20 active credentials, and each project up to 50.
• A credential expires after 1–365 days; the default is 90 days.
• When you rotate a credential, the old one can keep working for up to 168 hours.

For all limits, see OpenStack API limits.

Related servicesCopy Anchor Link

• Identity & Access Management: roles, service accounts, and two-factor authentication.
• Virtual Machines: instances that you can also manage through the APIs.
• Block Storage: the volumes that Cinder CSI creates.
• Load Balancers: the load balancers that OCCM creates.
• Quotas: the limits that API-created resources count against.

Next stepsCopy Anchor Link