Authenticating with OpenStackSDK using Keycloak credentials on ESA HPC
If you use OpenStackSDK to write your own OpenStack automation or application, you need to authenticate your code before it can manage cloud resources.
When users sign in to ESA HPC manually through https://administration.eohpc.net/login, they normally use the browser-based login flow. A screen like this appears:
Browser-based sign-in page
The code in this article shows how to prepare authentication data for OpenStackSDK using values from an OpenStack RC file. This lets your Python code authenticate to OpenStack using Keycloak / OpenID Connect data from the same environment.
What we are going to do
Install Python and prepare a Python virtual environment.
Download an OpenStack RC file from Horizon.
Source the RC file and authenticate.
Prepare Python code that uses values from the RC file for OpenStackSDK authentication.
Prerequisites
No. 1 Python and virtual environment
You need Python, pip, and a Python virtual environment.
How to install Python virtualenv or virtualenvwrapper on ESA HPC
No. 2 OpenStack RC file
The OpenStack RC file is available from Horizon. It provides environment variables used for authenticating OpenStack CLI and SDK tools.
Step 1: Source your RC file
Download the RC file for the region you want to use. In Linux and UNIX-like environments, the file can be loaded with the source command.
After you source the file, it asks for your password and exports OpenStack environment variables whose names start with OS_.
The exact endpoints depend on the region. Use the tab for your region.
Note
In your real RC file, keep the exact values generated by Horizon. The block above shows the structure of the variables and the regional endpoint values.
Step 2: Create Python code for OpenStackSDK authentication
In this step, you copy the required values from the RC file into your Python code.
For example, the value of OS_DISCOVERY_ENDPOINT from the RC file becomes the value of auth[‘discovery_endpoint’] in your Python code.
The discovery endpoint is region-specific:
A basic authentication dictionary can look like this:
Replace placeholder values such as Your E-mail Address, Your Domain ID, Your Project Name, and Your Project ID with values from your RC file or from your OpenStack project configuration.
Step 3: Use the code in your application
You can now use the authentication dictionary when creating an OpenStackSDK connection.
Example:
After this is configured, your application can authenticate to OpenStack and run OpenStackSDK operations without requiring the user to manually enter the same connection data each time.