Provisioning Instance OpenStack with Public Access Using Terraform

Ach.Chusnul Chikam
5 min readJul 27, 2022


You should see related content below to comply with some requirements before executing terraform,
Provisioning Basic Instance with Terraform


  • Endpoint keystone overcloud
  • Access user to OpenStack environment
  • Terraform project
  • OpenStack user role as admin
  • Terraform CLI (1.2.0+) installed
  • OpenStack Client installed
  • OpenStack image

Provide Requirements on the OpenStack side:

Create RC file if needed to verify OpenStack resource from CLI

cat <<EOF> /home/stack/terraform-rc
for key in $( set | awk '{FS="="} /^OS_/ {print $1}' ); do unset $key ; done
export NOVA_VERSION=1.1
export OS_USER_DOMAIN_NAME=Default
export OS_NO_CACHE=True
export OS_CLOUDNAME=terraform
export no_proxy=,,
export PYTHONWARNINGS='ignore:Certificate has no, ignore:A true SSLContext object is not available'
export OS_AUTH_TYPE=password
export OS_AUTH_URL=
export OS_COMPUTE_API_VERSION=2.latest
export OS_REGION_NAME=regionOne
if [ -z "${CLOUDPROMPT_ENABLED:-}" ]; then
export PS1=${PS1:-""}
export PS1=\${OS_CLOUDNAME:+"(\$OS_CLOUDNAME)"}\ $PS1

Create a project, user and assign role as admin. This will use by Terraform to create resources.

source ~/terraform-rc
openstack project create --description 'terraform project' terraform
openstack user create --project terraform --password PASSWORD terra
openstack role add --project terraform --user terra admin

Create OpenStack Provider

The OpenStack provider is used to interact with the many resources supported by OpenStack. The provider needs to be configured with the proper credentials before it can be used. Let’s follow this example:

Create a new directory and go into it

mkdir terraform
cd terraform

Create OpenStack provider configuration

cat <<EOF> /home/stack/terraform/
terraform {
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"
version = "1.47.0"
# Configure the OpenStack Provider credensial
provider "openstack" {
user_name = "terra"
tenant_name = "terraform"
password = "PASSWORD"
auth_url = ""
region = "regionOne"

When you create a new configuration or check out an existing configuration from version control you need to initialize the directory with terraform init.
Initializing a configuration directory downloads and installs the providers defined in the configuration, which in this case is the OpenStack provider.

terraform init

Write Configuration

The set of files used to describe infrastructure in Terraform is known as a Terraform configuration. You will write your first configuration to define a single OpenStack instance without public access.

Create file, then write configuration to create flavor, volume, keypair and security group.

resource "openstack_compute_flavor_v2" "tf_flavor1" {
name = "tf-flavor"
ram = "512"
vcpus = "1"
disk = "0"
is_public = true
resource "openstack_blockstorage_volume_v2" "tf-vol1" {
name = "myvol"
size = 5
resource "openstack_compute_keypair_v2" "tf-keypair" {
name = "terra-keypair"
resource "openstack_compute_secgroup_v2" "tf-secgroup1" {
name = "tf-secgroup"
description = "a security group by terraform"
rule {
from_port = 22
to_port = 22
ip_protocol = "tcp"
cidr = ""

Stay continues to create resources that relate public-net, public-subnet, private-net, private-subnet, router and attach the interface of both networks to the router.

###....Still in
resource "openstack_networking_network_v2" "tf-publicnet" {
name = "public"
segments {
network_type = "flat"
physical_network = "datacentre"
shared = "true"
admin_state_up = "true"
external = "true"
resource "openstack_networking_subnet_v2" "tf-publicsubnet" {
name = "public-sub"
network_id = "${}"
cidr = ""
ip_version = 4
enable_dhcp = "true"
gateway_ip = ""
allocation_pool {
end = ""
start = ""
dns_nameservers = ["",""]
resource "openstack_networking_network_v2" "tf-network1" {
name = "tf-net"
admin_state_up = "true"
resource "openstack_networking_subnet_v2" "tf-subnet1" {
name = "tf-subnet"
network_id = "${}"
cidr = ""
ip_version = 4
resource "openstack_networking_router_v2" "tf-router" {
name = "terra-router"
admin_state_up = true
external_network_id = "${}"
resource "openstack_networking_router_interface_v2" "tf-router_interface" {
router_id = "${}"
subnet_id = "${}"

Keep next create resources that relate floating ip, launch an instance, attach volume and floating ip to the instance. Save the configuration in one file

###....Still in
resource "openstack_networking_floatingip_v2" "tf-fip1" {
pool = "${}"
depends_on = []
resource "openstack_compute_instance_v2" "tf-vm1" {
name = "tf-vm"
image_name = "ubuntu20"
flavor_id = "${}"
key_pair = "${}"
security_groups = ["${}"]

network {
name = "${}"
user_data = file("user_data.yaml")
resource "openstack_compute_volume_attach_v2" "attached" {
instance_id = "${}"
volume_id = "${}"
resource "openstack_compute_floatingip_associate_v2" "tf-fip1" {
floating_ip = "${}"
instance_id = "${}"

Create user_data.yaml file to inject password via cloud-init.

cat <<EOF> /home/stack/terraform/user_data.yaml
ssh_pwauth: True
list: |
expire: False

Create Infrastructure

Apply the configuration now with the terraform apply command. Terraform will print output similar to what is shown below. We have truncated some of the output to save space.

Before it applies any changes, Terraform prints out the execution plan which describes the actions Terraform will take in order to change your infrastructure to match the configuration. In this case, the plan is acceptable so type yes at the confirmation prompt to proceed. Executing the plan will take a few minutes since Terraform waits for the OpenStack instance to become available.

You have now created infrastructure using Terraform!!!
Inspect the current state using terraform show.

terraform show

Verify Resources

Verify resources on OpenStack that have already been created with Terraform

terraform output#Notice floating ip
ssh ubuntu@<FLOATING_IP>

Now, check resources via Horizon Dashboard.
1. Instance

2. Volume

3. Network Topology

4. Router

5. Network

6. Floating IP

7. Security Group

8. Key pair

See other content

References :

#RHEL #Terraform #OpenStack #IaC #Hashicorp



Ach.Chusnul Chikam

Cloud Consultant | RHCSA | CKA | AWS SAA | OpenStack Certified | OpenShift Certified | Google Cloud ACE | LinkedIn: