Bulutistan CloudDocs
Security & IdentityOpenStack API Access

Use Terraform

Configure the Terraform OpenStack provider with the files of an application credential, and create and manage resources in a project with Terraform.

Terraform manages your project's resources through the OpenStack provider, terraform-provider-openstack/openstack. The provider signs in with an application credential that it reads from clouds.yaml, so your Terraform files don't contain the secret.

Before you begin

  • Install Terraform.
  • Create an application credential with the Full access profile in the project, and download clouds.yaml and main.tf. See Create an application credential.
  • For Terraform that a team or a CI pipeline runs, use a service account's credential, one per pipeline. A personal credential stops working when its owner leaves your organization or loses their role in the project.

Configure the provider

Put main.tf and clouds.yaml in the same folder, or put clouds.yaml in ~/.config/openstack/. The main.tf file that the console generates looks like this:

main.tf
terraform {
  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 3.4"
    }
  }
}

provider "openstack" {
  cloud = "bulutistan"
}

# Read-only check that the credential works: the project it is bound to.
data "openstack_identity_auth_scope_v3" "current" {
  name = "current"
}

output "project_id" {
  value = data.openstack_identity_auth_scope_v3.current.project_id
}

cloud = "bulutistan" selects the entry of the same name in clouds.yaml. The region and the endpoint come from that file too.

Verify

Check the configuration
terraform init
terraform apply

terraform apply prints project_id, the ID of the project that the credential is bound to. The configuration only reads data, so it creates nothing.

Create resources

This example creates a network, a subnet, and a security group with a rule that allows HTTPS from anywhere. Add it to main.tf, or replace the data source and output with it:

main.tf
resource "openstack_networking_network_v2" "app" {
  name = "tf-quickstart"
}

resource "openstack_networking_subnet_v2" "app" {
  name       = "tf-quickstart"
  network_id = openstack_networking_network_v2.app.id
  cidr       = "192.168.50.0/24"
  ip_version = 4
}

resource "openstack_networking_secgroup_v2" "web" {
  name        = "tf-quickstart-web"
  description = "HTTPS in"
}

resource "openstack_networking_secgroup_rule_v2" "https" {
  security_group_id = openstack_networking_secgroup_v2.web.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
}

output "network_id" {
  value = openstack_networking_network_v2.app.id
}
Apply and clean up
terraform plan
terraform apply
terraform destroy

terraform destroy deletes the resources again.

How Terraform resources relate to the console

  • Resources that Terraform creates are the same resources that you see in the console. They appear in the project and are billed like resources that you create in the console.
  • They count against the subscription's quota and the project's allocation. A request that would go over the allocation is refused. See Quotas.

Check which resource types you can use

In the console, the OpenStack API guide lists the resource types of the Terraform provider and their support status on this cloud. To open it, go to Identity & AccessOpenStack API access, and select Guide. Check a resource type there before you use it in a configuration.

Use the openstack CLI

Previous Page

Use OCCM and Cinder CSI in Kubernetes

Next Page

On this page

Before you beginConfigure the providerVerifyCreate resourcesHow Terraform resources relate to the consoleCheck which resource types you can useRelated