Terraform is an open source Infrastructure-as-Code software tool used for provisioning networks, servers, cloud platforms, and more. Terraform is a declarative language that can act as a blueprint of the infrastructure you're working on. You can manage it with Git, and it has a strong GitOps use case. After having an OpenStack production and home lab for a while, provisioning a workload and managing it from an Admin and Tenant perspective is important. OpenStack powers a significant number of private clouds and some public cloud offerings around the world. If your organization runs OpenStack, the Terraform provider for it lets you manage compute instances, networks, block storage, object storage, and other resources through infrastructure as code.
This article covers the basics of managing an OpenStack cluster using Terraform. The approach recreates an OpenStack Demo project using Terraform and demonstrates how to write out your cloud's infrastructure as code, commonly referred to as IaC. Using an IaC model allows software development practices to be applied to your cloud's infrastructure. A cloud's infrastructure as code can then be shared and iterated over as needed.
Why Terraform for OpenStack
Terraform allows you to write out your cloud's infrastructure as code. This document provides a comprehensive guide for provisioning and managing OpenStack infrastructure using Terraform, an Infrastructure as Code tool. It outlines the necessary steps for configuring Terraform, authenticating with OpenStack, and deploying virtual machine instances.
The guide serves as a technical reference for the infrastructure team and club members seeking to automate OpenStack resource deployment using Terraform. The scope covers Terraform fundamentals, OpenStack application credential generation, Terraform project setup and configuration, and virtual machine instance deployment.
Terraform is a declarative language. You describe the desired state and Terraform converges the actual state to match. Because the configuration is text, it can be versioned, reviewed, and applied consistently across environments. Managing it with Git provides auditability and rollback capability.
Prerequisites and Control Node Setup
The following prerequisites must be met prior to proceeding with provisioning.
| Requirement | Detail |
|---|---|
| OpenStack Cloud Access | Valid credentials for an OpenStack environment are required |
| Control Node | A dedicated system physical or virtual with Terraform installed. It is recommended to deploy a virtual machine within the OpenStack environment for this purpose |
| Terraform Installation | Terraform CLI must be installed on the Control Node |
| OpenStack User Account | An OpenStack user account. The account does not have to have the administrator role |
| Linux Command Line Experience | Required for running commands |
| Internet Access | Terraform should be installed to a machine that has Internet access to your Private Cloud |
When working with Terraform, we suggest creating a folder to manage your Terraform plans and execution files. For example:
mkdir ~/terraform
The Control Node can be your own machine or one of your cloud's hardware nodes. Creating a dedicated directory for the Terraform project on the Control Node isolates state and configuration.
mkdir terraform_project && cd terraform_project
Installing Terraform on CentOS
A common practice is to use CentOS as a jump host where Terraform runs. Based on the official documentation, the first step is to add the Hashicorp repository.
$ sudo dnf config-manager \
--add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
Next, install Terraform:
$ sudo dnf install terraform -y
Verify the installation:
$ terraform –version
If you see a version number in return, you have installed Terraform. Terraform CLI must be installed on the Control Node before proceeding.
OpenStack Application Credentials
Application credentials are required for Terraform to authenticate with OpenStack.
Credential generation follows a web workflow in Horizon.
- Access Horizon Dashboard: Log in to the OpenStack Horizon web interface
- Navigate to Identity: Proceed to "Identity" > "Application Credentials"
- Create Credentials: Initiate the credential creation process by clicking "Create Application Credential"
- Configuration: Provide a descriptive name, optional description, and an expiration date. Leave other fields at their default values
- Download clouds.yaml: Download the generated clouds.yaml file, which contains the application credentials
To point Terraform to the appropriate cloud and authenticate, you can generate a set of OpenStack Application Credentials. The downloaded clouds.yaml file contains the application credentials and is used by the provider to locate the cloud endpoint.
Placement of the credentials file is important for local authentication. Move the downloaded clouds.yaml file into the terraform_project directory.
The clouds.yaml structure defines the cloud name that Terraform will reference. An example start of clouds.yaml appears as:
clouds:
openstack:
auth:
auth_url: https://cloud.example.com:5000
The line immediately following clouds: is the name of your cloud. For this example the name is openstack, indicating the name of this cloud is openstack.
Project Structure and Configuration Files
Create the following Terraform configuration files: main.tf and variables.tf.
touch main.tf variables.tf
Project files can be organized as follows:
| File | Purpose |
|---|---|
| providers.tf | Declares required providers and versions |
| main.tf | Contains provider configuration and resource definitions |
| variables.tf | Defines input variables to parameterize deployment |
| clouds.yaml | Contains OpenStack application credentials, placed in project directory |
Provider Definition and Initialization
When working with Terraform, you must specify a provider. There are a number of providers to choose from located in Terraform's Providers website. For OpenStack powered clouds, Terraform's OpenStack Provider is required.
To specify the OpenStack provider, create a file called providers.tf in your Terraform directory containing:
terraform {
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"
version = "1.46.0"
}
}
}
With a provider defined, Terraform must be initialized.
terraform init
When Terraform has been successfully initialized, the following message is returned:
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
Initialization downloads provider plugins and prepares the working directory.
Configuring the OpenStack Provider
To do so, we must create a template, define the openstack provider, and define a compute resource.
Within your Terraform directory, create a file called main.tf. Then, for the OpenStack provider, configure the cloud to point to:
provider "openstack" {
cloud = "openstack"
}
The value for cloud can be variable. For our case the value should be set to openstack. This is determined by examining the clouds.yaml downloaded in the previous section. The line immediately following clouds: is the name of your cloud. For this example, the start of clouds.yaml appears as shown above. The line immediately following clouds: is openstack:, indicating the name of this cloud is openstack and thus the value for cloud is set as cloud = "openstack".
With the provider section configured, you can now define a compute resource. Terraform allows you to write out your cloud's infrastructure as code and spin up an instance within a OpenMetal Private Cloud or any OpenStack environment.
Parameterization with variables.tf
Define input variables in variables.tf to parameterize the infrastructure deployment. Parameterization avoids hard coding values and makes the configuration reusable across environments and teams.
The document covers Terraform fundamentals and OpenStack application credential generation as part of a comprehensive guide for provisioning and managing OpenStack infrastructure. The configuration files support a workflow where infrastructure is described declaratively and applied consistently.
Launching Instances as Code
The process of creating an instance using Terraform follows the prepared directory, provider specification, initialization, credential creation, and provider configuration steps. Terraform should be installed to a machine that has Internet access to your Private Cloud. This could be your own machine or one of your cloud's hardware nodes, for example.
When working with Terraform, we suggest creating a folder to manage your Terraform plans and execution files. The provider is specified in providers.tf, initialized with terraform init, and the OpenStack provider is configured in main.tf using the cloud name from clouds.yaml.
This model allows software development practices to be applied to your cloud's infrastructure. A cloud's infrastructure as code can then be shared and iterated over as needed. Managing it with Git provides a strong GitOps use case for OpenStack environments.
Conclusion
Using Terraform with OpenStack delivers a repeatable, versioned method for provisioning compute instances, networks, block storage, object storage, and other resources through infrastructure as code. The workflow begins with a Control Node where Terraform is installed, often CentOS as a jump host, with the Hashicorp repository added and Terraform installed via dnf. Authentication relies on OpenStack Application Credentials created through Horizon Identity > Application Credentials, with the resulting clouds.yaml placed in the project directory.
Project setup creates a dedicated directory, main.tf and variables.tf, and a providers.tf declaring the openstack provider source terraform-provider-openstack/openstack with version 1.46.0. Initialization with terraform init prepares the working directory, and the provider is configured with cloud = "openstack" matching the name defined in clouds.yaml.
This approach supports both Admin and Tenant perspectives for provisioning workloads and managing them consistently. Terraform's declarative nature and Git compatibility make OpenStack infrastructure auditable and collaborative, while application credentials ensure secure authentication without interactive logins. The resulting pipeline enables teams to automate OpenStack resource deployment with confidence.