Using the command-line tools with HTTPS

When OpenStack Identity endpoint is configured to use HTTPs, using the command-line tools with OpenStack Compute will require specifying SSL certificates for validation.

Getting ready

The tools will be installed on your host computer if it’s running Ubuntu, which is the easiest way to get hold of the nova client packages ready to manage your cloud environment. If using our Vagrant lab environment, self-signed certificates are installed and set up for using with HTTPS endpoints. We recommend that you use certificates issued by a trusted Certificate Authority (CA) for your production environment.

How to do it...

The nova client packages are conveniently available from the Ubuntu repositories. SSL certificates are already installed and configured for use by Keystone for validation.

  1. As a normal user on our Ubuntu machine, type the following commands:
    sudo apt-get update
sudo apt-get install python-novaclient
  2. After installing the command-line tools, set up your environment credentials. You will need to use your OpenStack cluster’s SSL certificates. Adjust the path to your certificates and key file to match your environment, if not using the Vagrant environment:
    export OS_TENANT_NAME=cookbook
export OS_USERNAME=admin
export OS_PASSWORD=openstack
export OS_AUTH_URL=https://192.168.100.200:5000/v2.0/
export OS_NO_CACHE=1
export OS_KEY=/vagrant/cakey.pem
export OS_CACERT=/vagrant/ca.pem

    Note

    Note that we have set up the OS_KEY environment variable points to our private key. The OS_CACERT variable points to the CA bundle file to use in verifying a TLS (https) server certificate.

  3. For troubleshooting certificate or connectivity issues, you can use the --insecure flag to bypass SSL validation. When using this flag with the nova command-line client, your server’s certificate will not be verified against any certificate authorities.

    Tip

    Note that the --insecure flag is very useful for troubleshooting connectivity issues. It also bypasses all certificate validation—they may as well not even be enabled.

How it works...

Using nova client on Ubuntu is a very natural way to manage our OpenStack cloud environment. However, if your authentication endpoints are setup to use HTTPS, you will need to point your command-line client to the certificates installed on your system. Adding environment variables to point to certificates will automatically validate against them.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset