Provisioning Basic Instance on OpenStack using Terraform

What is Terraform?

Terraform is a tool you can use to “sync” your infrastructure (VMs in Clouds, DNS records, etc.) with code you have written in configuration files. This is known as Infrastructure as Code. Knowing that your infrastructure is exactly what you expect it to be can simplify your operations significantly. You can have confidence that if anything changes, any images crash or are accidentally deleted, you can immediately rebuild your infrastructure.

Terraform supports many providers, allowing you to easily manage resources no matter where they are located. In this article, I would like to tell you about how to provision a basic instance on OpenStack with Terraform.


  • Endpoint keystone overcloud
  • Access user to openstack environment
  • Terraform project
  • OpenStack user role as admin
  • Terraform CLI (1.2.0+) installed
  • OpenStack Client installed

Provide Requirements on the OpenStack side:

Install OpenStack client on CentOS 7

sudo yum install
sudo yum upgrade
sudo yum install python-openstackclient
openstack --help
yum install bash-completion
openstack complete | sudo tee /etc/bash_completion.d/osc.bash_completion > /dev/null
#Exit >< Relogin

Create RC file if needed to verify OpenStack resource from CLI

cat <<EOF> /home/stack/terraform-rc
for key in $( set | awk '{FS="="} /^OS_/ {print $1}' ); do unset $key ; done
export NOVA_VERSION=1.1
export OS_USER_DOMAIN_NAME=Default
export OS_NO_CACHE=True
export OS_CLOUDNAME=terraform
export no_proxy=,,
export PYTHONWARNINGS='ignore:Certificate has no, ignore:A true SSLContext object is not available'
export OS_AUTH_TYPE=password
export OS_AUTH_URL=
export OS_COMPUTE_API_VERSION=2.latest
export OS_REGION_NAME=regionOne
if [ -z "${CLOUDPROMPT_ENABLED:-}" ]; then
export PS1=${PS1:-""}
export PS1=\${OS_CLOUDNAME:+"(\$OS_CLOUDNAME)"}\ $PS1

Create a project, user and assign role as admin. This will use by Terraform to create resources.

source ~/terraform-rc
openstack project create --description 'terraform project' terraform
openstack user create --project terraform --password PASSWORD terra
openstack role add --project terraform --user terra admin

Install Terraform

Install Terraform on CentOS 7

sudo yum install -y yum-utils
sudo yum-config-manager --add-repo
sudo yum -y install terraform
terraform -help

Create OpenStack Provider

The OpenStack provider is used to interact with the many resources supported by OpenStack. The provider needs to be configured with the proper credentials before it can be used. Let's follow this example:

Create a new directory and go into it

mkdir terraform
cd terraform

Create OpenStack provider configuration

#Create provider.yaml
cat <<EOF> /home/stack/terraform/provider.yaml
terraform {
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"
version = "1.47.0"
# Configure the OpenStack Provider credensial
provider "openstack" {
user_name = "terra"
tenant_name = "terraform"
password = "PASSWORD"
auth_url = ""
region = "regionOne"


When you create a new configuration or check out an existing configuration from version control you need to initialize the directory with terraform init.
Initializing a configuration directory downloads and installs the providers defined in the configuration, which in this case is the OpenStack provider.

terraform init

Write Configuration

The set of files used to describe infrastructure in Terraform is known as a Terraform configuration. You will write your first configuration to define a single OpenStack instance without public access.

Create network.yaml file for resources that relate to network, subnet, security group.

cat <<EOF> /home/stack/terraform/network.yaml
resource "openstack_networking_network_v2" "tf-network1" {
name = "tf-net"
admin_state_up = "true"
resource "openstack_networking_subnet_v2" "tf-subnet1" {
name = "tf-subnet"
network_id = "${}"
cidr = ""
ip_version = 4
resource "openstack_compute_secgroup_v2" "tf-secgroup1" {
name = "tf-secgroup"
description = "a security group by terraform"
rule {
from_port = 22
to_port = 22
ip_protocol = "tcp"
cidr = ""

Create main.yaml to create resources that relate flavor, volume, keypair, and instance

cat <<EOF> /home/stack/terraform/main.yaml
resource "openstack_compute_instance_v2" "tf-vm1" {
name = "tf-vm"
image_name = "ubuntu20"
flavor_id = "${}"
key_pair = "${}"
security_groups = ["${}"]
network {
name = "${}"
user_data = file("user_data.yaml")
resource "openstack_compute_flavor_v2" "tf_flavor1" {
name = "tf-flavor"
ram = "512"
vcpus = "1"
disk = "0"
is_public = true
resource "openstack_compute_keypair_v2" "tf-keypair" {
name = "terra-keypair"
resource "openstack_blockstorage_volume_v2" "tf-vol1" {
name = "myvolume"
size = 5
resource "openstack_compute_volume_attach_v2" "attached" {
instance_id = "${}"
volume_id = "${}"

Create user_data.yaml file to inject password via cloud-init.

cat <<EOF> /home/stack/terraform/user_data.yaml
ssh_pwauth: True
list: |
expire: False

A complete configuration that you write can deploy a single instance on OpenStack with Terraform.

Create Infrastructure

Apply the configuration now with the terraform apply command. Terraform will print output similar to what is shown below. We have truncated some of the output to save space.

Before it applies any changes, Terraform prints out the execution plan which describes the actions Terraform will take in order to change your infrastructure to match the configuration. In this case the plan is acceptable, so type yes at the confirmation prompt to proceed. Executing the plan will take a few minutes since Terraform waits for the OpenStack instance to become available.

You have now created infrastructure using Terraform! Inspect the current state using terraform show.

terraform show

Verify Resources

Verify resources that have already been created with Terraform on OpenStack side using OpenStack CLI.

cat <<EOF> /home/stack/terraform/
source ~/terraformrc
echo -e "\n===== VERIFY VM =====\n"
openstack server list --project terraform
echo -e "\n===== VERIFY VOLUME =====\n"
openstack volume list --project terraform
echo -e "\n===== VERIFY FLAVOR =====\n"
openstack flavor list -f yaml | grep tf -A2 -B4
echo -e "\n===== VERIFY NETWORK =====\n"
openstack network list -f yaml | grep tf -A2 -B1
echo -e "\n===== VERIFY SUBNET =====\n"
openstack subnet list -f yaml | grep tf -A2 -B1
echo -e "\n===== VERIFY KEYPAIR =====\n"
openstack keypair list -f yaml
echo -e "\n===== VERIFY SECGROUP =====\n"
openstack security group list -f yaml | grep tf -A2 -B2
bash ~/terraform/

Now, crosscheck on Horizon Dashboard.
1. Network

2. Security Group

3. Volume

4. Key pair

5. Inside VM

Destroy Infrastructure

The terraform destroy command terminates resources managed by your Terraform project. This command is the inverse of terraform apply in that it terminates all the resources specified in your Terraform state. It does not destroy resources running elsewhere that are not managed by the current Terraform project.

Destroy the resources you created.

Answer yes to execute this plan and destroy the infrastructure.

See other content

References :

#CentOS #Terraform #OpenStack #IaC #Hashicorp



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store