openstack.cloud.application_credential module – Manage OpenStack Identity (Keystone) application credentials

Note

This module is part of the openstack.cloud collection (version 2.3.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install openstack.cloud. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: openstack.cloud.application_credential.

Synopsis

• Create or delete an OpenStack Identity (Keystone) application credential.

• When the secret parameter is not set a secret will be generated and returned

• in the response. Existing credentials cannot be modified so running this module

• against an existing credential will result in it being deleted and recreated.

• This needs to be taken into account when the secret is generated, as the secret

• will change on each run of the module.

Requirements

The below requirements are needed on the host that executes this module.

• python >= 3.6

• openstacksdk >= 1.0.0

Parameters

Parameter	Comments
access_rules list / elements=dictionary	List of access rules, each containing a request method, path, and service.
method string / required	HTTP method
path string / required	Path portion of access URL
service string / required	Name of service endpoint
api_timeout integer	How long should the socket layer wait before timing out for API calls. If this is omitted, nothing will be passed to the requests library.
auth dictionary	Dictionary containing auth information as needed by the cloud’s auth plugin strategy. For the default password plugin, this would contain auth_url, username, password, project_name and any information about domains (for example, user_domain_name or project_domain_name) if the cloud supports them. For other plugins, this param will need to contain whatever parameters that auth plugin requires. This parameter is not needed if a named cloud is provided or OpenStack OS_* environment variables are present.
auth_type string	Name of the auth plugin to use. If the cloud uses something other than password authentication, the name of the plugin should be indicated here and the contents of the auth parameter should be updated accordingly.
ca_cert aliases: cacert string	A path to a CA Cert bundle that can be used as part of verifying SSL API requests.
client_cert aliases: cert string	A path to a client certificate to use as part of the SSL transaction.
client_key aliases: key string	A path to a client key to use as part of the SSL transaction.
cloud any	Named cloud or cloud config to operate against. If cloud is a string, it references a named cloud config as defined in an OpenStack clouds.yaml file. Provides default values for auth and auth_type. This parameter is not needed if auth is provided or if OpenStack OS_* environment variables are present. If cloud is a dict, it contains a complete cloud configuration like would be in a section of clouds.yaml.
description string	Application credential description.
expires_at string	Sets an expiration date for the application credential, format of YYYY-mm-ddTHH:MM:SS (if not provided, the application credential will not expire).
interface aliases: endpoint_type string	Endpoint URL type to fetch from the service catalog. Choices: "admin" "internal" "public" ← (default)
name string / required	Name of the application credential.
region_name string	Name of the region.
roles list / elements=dictionary	Roles to authorize (name or ID).
domain_id string	Domain ID
id string	ID of role
name string	Name of role
sdk_log_level string	Log level of the OpenStackSDK Choices: "INFO" ← (default) "DEBUG"
sdk_log_path string	Path to the logfile of the OpenStackSDK. If empty no log is written
secret string	Secret to use for authentication (if not provided, one will be generated).
state string	Should the resource be present or absent. Application credentials are immutable so running with an existing present credential will result in the credential being deleted and recreated. Choices: "present" ← (default) "absent"
timeout integer	How long should ansible wait for the requested resource. Default: 180
unrestricted boolean	Enable application credential to create and delete other application credentials and trusts (this is potentially dangerous behavior and is disabled by default). Choices: false ← (default) true
validate_certs aliases: verify boolean	Whether or not SSL API requests should be verified. Before Ansible 2.3 this defaulted to true. Choices: false true
wait boolean	Should ansible wait until the requested resource is complete. Choices: false true ← (default)

Notes

Note

• The standard OpenStack environment variables, such as OS_USERNAME may be used instead of providing explicit values.

• Auth information is driven by openstacksdk, which means that values can come from a yaml config file in /etc/ansible/openstack.yaml, /etc/openstack/clouds.yaml or ~/.config/openstack/clouds.yaml, then from standard environment variables, then finally by explicit parameters in plays. More information can be found at https://docs.openstack.org/openstacksdk/

Examples

- name: Create application credential
  openstack.cloud.application_credential:
    cloud: mycloud
    description: demodescription
    name: democreds
    state: present

- name: Create application credential with expiration, access rules and roles
  openstack.cloud.application_credential:
    cloud: mycloud
    description: demodescription
    name: democreds
    access_rules:
    - service: "compute"
      path: "/v2.1/servers"
      method: "GET"
    expires_at: "2024-02-29T09:29:59"
    roles:
    - name: Member
    state: present

- name: Delete application credential
  openstack.cloud.application_credential:
    cloud: mycloud
    name: democreds
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
application_credential dictionary	Dictionary describing the project. Returned: On success when state is present.
access_rules list / elements=dictionary	A list of access_rules objects Returned: success Sample: [{"id": "edecb6c791d541a3b458199858470d20", "method": "GET", "path": "/v2.1/servers", "service": "compute"}]
description string	A description of the application credential’s purpose. Returned: success Sample: "App credential"
expires_at string	The expiration time of the application credential in UTC, if one was specified. Returned: success Sample: "2024-02-29T09:29:59.000000"
id string	The ID of the application credential. Returned: success Sample: "2e73d1b4f0cb473f920bd54dfce3c26d"
name string	The name of the application credential. Returned: success Sample: "appcreds"
project_id string	The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to. Returned: success Sample: "4b633c451ac74233be3721a3635275e5"
roles list / elements=dictionary	A list of one or more roles that this application credential has associated with its project. A token using this application credential will have these same roles. Returned: success Sample: [{"name": "Member"}]
secret string	Secret to use for authentication (if not provided, returns the generated value). Returned: success Sample: "JxE7LajLY75NZgDH1hfu0N_6xS9hQ-Af40W3"
unrestricted boolean	A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Returned: success
cloud dictionary	The current cloud config with the username and password replaced with the name and secret of the application credential. This can be passed to the cloud parameter of other tasks, or written to an openstack cloud config file. Returned: On success when state is present. Sample: {"auth": {"application_credential_id": "3e73d1b4f0cb473f920bd54dfce3c26d", "application_credential_secret": "JxE7LajLY75NZgDH1hfu0N_6xS9hQ-Af40W3", "auth_url": "https://192.0.2.1/identity"}, "auth_type": "v3applicationcredential"}

Authors

• OpenStack Ansible SIG

Collection links

• Issue Tracker
• Repository (Sources)