Create an application credential
Switch on OpenStack API access, create an application credential for yourself or a service account, choose its profile, and download its files.
An application credential lets OpenStack tools sign in to one of your projects. You create it in the console, and the console shows its secret once, together with ready-made configuration files.
Before you begin
- Your organization's OpenStack API access must be switched on. See Turn OpenStack API access on or off.
- Set up two-factor authentication on your account. Creating or rotating a credential, and switching OpenStack API access on or off, need a recent two-factor verification on your console session. See Step-up verification.
- Open the project that the credential is for. A credential belongs to one project.
- To create a credential for yourself, your access in the project must allow one of the profiles that the form offers. See Profiles.
- To create a credential for a service account, you need the Owner role, or a custom role with Manage access to API Tokens, and your own OpenStack roles in the project must include all of the service account's.
Turn OpenStack API access on or off
OpenStack API access is off for a new organization. Only an owner of the subscription sees the switch and can change it.
In the console, go to Identity & AccessOpenStack API access.
In the Organisation API access panel, select Switch on.
Enter a code from your authenticator app when the console asks for it.
Caution
Switching access off deletes every OpenStack identity of your organization, and with it every application credential, in every project. Credentials don't come back when you switch access on again; they must be created again.
To switch access off:
In the console, go to Identity & AccessOpenStack API access.
In the Organisation API access panel, select Switch off.
If the console asks for it, enter a code from your authenticator app.
Check the number of identities and active credentials that are deleted, and select the I understand that every OpenStack credential of the organisation stops working check box.
Select Switch off and delete.
Create a credential
Go to Identity & AccessOpenStack API access, and select New credential.
Enter a Name.
Under Owner, select Me, or A service account and then the service account. The owner choice appears only when you can create credentials for service accounts and an enabled service account exists.
Under Profile, select a profile. The form lists every profile, and shows the reason next to a profile that you can't choose. See Profiles.
In Expires after, select how long the credential stays valid.
Select Create credential. If the console asks for it, enter a code from your authenticator app.
Copy the Application credential ID and the Secret, or download the files that you need under Ready-to-use files.
Select I have stored the secret, and then Done.
Important
The secret is shown once, on this screen. If you lose it, rotate the credential or create a new one.
| Field | Rules |
|---|---|
| Name | 1–63 characters: letters, digits, spaces, ., _, and -. It must start with a letter or a digit and can't end with a space. It can't start with pc_live_ or sak_live_. |
| Owner | You, or an enabled service account. |
| Profile | A profile that your role allows. |
| Expires after | 7, 30, 90, 180, or 365 days. Every credential expires. An email goes out when 14 days or fewer are left, and again when 3 days or fewer are left: to you, or for a service account's credential, to the member who created it. |
The screen also lists the OpenStack roles granted.
Result
The credential appears in the list under Identity & AccessOpenStack API access with the status Active. Configure your tools with its ID and secret, or with the downloaded files. See Use the openstack CLI and Use Terraform.
Profiles
A profile sets the Keystone roles that the credential gets in the project. Under Profile, the form lists every profile, and shows the reason next to a profile that you can't choose.
The Full access profile gives the credential the Keystone roles member and load-balancer_member, so that it can create and manage resources in the project. To choose it, you need Manage access to compute, networking, and storage in the project, as with the Owner and Contributor roles.
- The load balancer role follows your Load Balancers permission. Without Manage on load balancers, a credential with the Full access profile gets
load-balancer_observerinstead ofload-balancer_member, or no load balancer role at all. The screen after creation shows the roles that were granted. - A credential never gets more than its owner's OpenStack roles in the project.
- For a service account's credential, the same rules apply to the service account's roles.
- If you can't choose any profile, the page says so, and you can't create a credential there.
Downloaded files
The console generates these files in your browser from the new credential:
| File | Use it for |
|---|---|
clouds.yaml | The openstack CLI, openstacksdk, and Terraform. The cloud entry is named bulutistan. |
openrc.sh | Loading the credential into a shell as environment variables. |
cloud.conf | The OpenStack cloud controller manager and Cinder CSI in Kubernetes. |
cloud-config-secret.yaml | The cloud.conf file as the Kubernetes Secret kube-system/cloud-config. |
main.tf | A Terraform starting point that reads clouds.yaml. |
Every file except main.tf contains the secret. Keep them private and out of version control.
The files point at the endpoint that the page shows under Endpoint, region and limits: the identity URL, in the form https://<identity-host>/v3, the region, the public interface, and the authentication type v3applicationcredential. Copy these values from the page if you configure a tool by hand.
Who sees which credentials
Identity & AccessOpenStack API access lists the credentials of the current project that you're allowed to see:
- your own credentials;
- the credentials of service accounts, if you have Manage access to API Tokens;
- every credential of the project, if you have Manage access to Identity & Access.
You can revoke the credentials that you can see. See Rotate and revoke credentials.
Troubleshooting
| Message | What to do |
|---|---|
| Direct OpenStack API access is off for your organisation. | Ask an owner of the subscription to switch on OpenStack API access. |
| This project is not ready on the cloud yet. Try again in a few minutes. | Wait, and try again. |
| Your role on this project does not allow this profile. | Choose another profile, or ask for a role with more access in the project. |
| The service account has OpenStack roles on this project that you do not. You cannot create a credential for it. | Ask someone whose access in the project covers the service account's to create the credential. |
| The credential limit is reached. Revoke an unused credential first. | Revoke a credential that you no longer use. See OpenStack API limits. |
| OpenStack credentials can only be created from a console session with two-factor authentication, not with an API token. | Create the credential in the console, signed in with two-factor authentication. |
| This request was already processed. Its secret was shown once and cannot be shown again; revoke that credential and create a new one if it was not stored. | If you didn't store the secret, revoke that credential, and create a new one. |