{"id":50385022,"url":"https://github.com/stackhpc/tofu-openstack-config","last_synced_at":"2026-05-30T14:30:52.324Z","repository":{"id":325087250,"uuid":"1095925075","full_name":"stackhpc/tofu-openstack-config","owner":"stackhpc","description":"PoC for openstack-config replacement using OpenTofu","archived":false,"fork":false,"pushed_at":"2026-05-27T12:48:20.000Z","size":81,"stargazers_count":1,"open_issues_count":3,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-27T14:25:46.098Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stackhpc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-13T17:43:16.000Z","updated_at":"2026-05-21T13:07:44.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/stackhpc/tofu-openstack-config","commit_stats":null,"previous_names":["stackhpc/tf-openstack-config-poc","stackhpc/tofu-openstack-config"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stackhpc/tofu-openstack-config","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Ftofu-openstack-config","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Ftofu-openstack-config/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Ftofu-openstack-config/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Ftofu-openstack-config/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stackhpc","download_url":"https://codeload.github.com/stackhpc/tofu-openstack-config/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Ftofu-openstack-config/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33696681,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-30T02:00:06.278Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-05-30T14:30:52.262Z","updated_at":"2026-05-30T14:30:52.316Z","avatar_url":"https://github.com/stackhpc.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# tofu-openstack-config\n\nAn OpenTofu module and tooling for configuring an existing OpenStack cloud,\ncurrently supporting defining projects, groups, users, role assignments, flavors and\nRBAC'd networks. See below for more details. Tooling is also provided to generate\nOpenTofu configurations from an existing cloud.\n\nIt is intended as an alternative to the Ansible project [stackhpc/openstack-config](https://github.com/stackhpc/openstack-config/),\nwith the aim of providing significantly better performance for large configurations\nand better idempotency.\n\n## Example module usage\n\nTo use the functionality here to define configuration for a cloud, create\nan OpenTofu configuration including a module block referencing it. E.g.:\n\n```hcl\n# main.hcl:\n\nmodule \"openstack\" {\n\n  # The version here should be changed to the current release:\n  source = \"github.com/stackhpc/tofu-openstack-config?ref=main\"\n\n  projects = {\n    test = {\n      description = \"test project\"\n      compute_quota = {\n        instances = 20\n        cores     = 200\n        ram       = 512000\n      }\n    }\n  }\n}\n```\n\nTo install this module into your project, run:\n```shell\ntofu init\n```\n\nOpenStack credentials should be provided as usual (e.g. via a `clouds.yaml` file\nwith `OS_CLIENT_CONFIG_FILE` and `OS_CLOUD` set). Admin credentials are required\nfor most uses of this module.\n\nThe resources defined in your configuration can then be created using:\n```shell\ntofu apply\n```\n\nFor more comprehensive examples see the `examples/` directory. The example\n`arcus` demonstrates how to use variables and the [merge function](https://opentofu.org/docs/language/functions/merge/)\nto minimise repeated configuration.\n\n## Functionality\n\nSee the module's [variables.tf](./variables.tf) for full details of inputs. Apart\nfrom a few exceptions noted there, the module generally only handles resources\ndefined as its inputs. E.g. when defining role assignments via the `role_assignments`\ninput, these can only reference projects defined in the `projects` input.\n\nBy default, OpenTofu [limits](https://opentofu.org/docs/cli/commands/apply/#apply-options)\nthe number of concurrent operations to 10. This means that for example only API\ncalls will be made simultaneously. For large configurations it may be helpful\nto raise this by using the `-parellelism` argument to `tofu apply.` This can\nbe set as a default in your shell using e.g.:\n\n```shell\nexport TF_CLI_ARGS_apply=\"-parallelism=25\"\n```\n\n### Comparison to stackhpc/openstack-config\n\nThis section provides an initial comparison of functionality vs:\n- https://github.com/stackhpc/openstack-config/blob/main/etc/openstack-config/openstack-config.yml\n- https://github.com/stackhpc/ansible-collection-openstack/tree/main/roles\nNote this is not currently complete either in breadth or depth!\n\nIn the \"Supported?\" column:\n- `Yes` indicates broadly-equivalent functionality is available\n- `New` indicates `stackhpc/openstack-config` does not support this\n\nThe \"Import?\" column refers to support for [importing existing openstack configuration](#importing-existing-openstack-configurations) below.\n\n| Feature           | Supported? | Import?  | Comments |\n| ----------------- | ---------- | -------- | -------- |\n| Domains           | No         | N/A      | Only the default domain is used |\n| Projects          | Yes        | Yes      | Keypairs not supported |\n| Groups            | Yes        | Yes      | |\n| Users             | Yes        | Yes      | |\n| Role assignments  | New        | Yes      | Only groups (not users) can be assigned roles |\n| Routers           | No         | N/A      | |\n| Security groups   | No         | N/A      | |\n| Network RBAC      | Yes        | No       | |\n| Flavors           | Yes        | Yes      | |\n| Host aggregates   | No         | N/A      | |\n| Images            | Yes        | No       | Does not support local_file_path for image upload |\n| Image elements    | No         | N/A      | Considered out of scope |\n| Ratings           | No         | N/A      | |\n\n## Current Issues\n\nThis section notes some issues hit during testing with `examples/arcus/`.\n\nDuring `tofu apply`:\n\n```\n│ Error: Provider produced inconsistent result after apply\n│\n│ When applying changes to module.roleB.openstack_identity_role_assignment_v3.A, provider \"provider[\\\"registry.opentofu.org/hashicorp/openstack\\\"]\" produced an unexpected new value: root object was present, but now absent.\n│\n│ This is a bug in the provider, which should be reported in the provider's own issue tracker.\n```\nBut reapplying fixed it ...\n\nAlso not idempotent:\n\n```\n  # module.openstack.module.projects[\"sb-test-1\"].openstack_blockstorage_quotaset_v3.project will be updated in-place\n  ~ resource \"openstack_blockstorage_quotaset_v3\" \"project\" {\n        id                   = \"75dc3b8cb1324ea6a899c8281b9ff84b/RegionOne\"\n      ~ volume_type_quota    = {\n          - \"gigabytes___DEFAULT__\"                          = \"-1\" -\u003e null\n          - \"gigabytes_arcus-staging-ceph01-rbd\"             = \"-1\" -\u003e null\n          - \"gigabytes_arcus-staging-ceph01-rbd-multiattach\" = \"-1\" -\u003e null\n          - \"snapshots___DEFAULT__\"                          = \"-1\" -\u003e null\n          - \"snapshots_arcus-staging-ceph01-rbd\"             = \"-1\" -\u003e null\n          - \"snapshots_arcus-staging-ceph01-rbd-multiattach\" = \"-1\" -\u003e null\n          - \"volumes___DEFAULT__\"                            = \"-1\" -\u003e null\n          - \"volumes_arcus-staging-ceph01-rbd-multiattach\"   = \"-1\" -\u003e null\n            # (1 unchanged element hidden)\n        }\n        # (9 unchanged attributes hidden)\n    }\n```\n\nDuring `tofu apply`:\n```\n Error: Error unassigning openstack_identity_role_assignment_v3 ...: Successfully re-authenticated, but got error executing request: Expected HTTP response code [204] when accessing [DELETE ..., but got 401 instead: {\"error\":{\"code\":401,\"message\":\"The request you have made requires authentication.\",\"title\":\"Unauthorized\"}}\n ```\n\nworked on 3rd attempt.\n\nDoes not appear to be fixable with `depends_on`, may be a bug in the underlying provider?\n\n## Importing existing OpenStack configurations\nThis repository contains some additional Python tooling which can query an\nexisting OpenStack cloud and define configurations which represent it.\n\n### Setup\n\nCreate a venv in your project directory:\n\n```shell\npython3 -m venv venv\n. venv/bin/activate\npip install -U pip\n```\n\nThen install the tooling, changing the version as necessary:\n\n```shell\npip install git+https://github.com/stackhpc/tofu-openstack-config@main\n```\n\n### Usage\n\nWith the venv activated and OpenStack credentials available as normal, run\n\n```shell\ntofu-os-cfg\n```\n\nThis will query OpenStack and generate:\n- `main.tf` - an example configuration using this module\n- `imports.tf` - [import blocks](https://opentofu.org/docs/language/import/)\nlinking the above configuration to the cloud resources.\n\nVarious options can be used to limit which resources are inspected, run\n`tofu-os-cfg --help` to see them.\n\nBy default the generated module path will depend on pip-installed package version.\n\nThe generated files should be reviewed and if necessary, modified. Note not all\nfeatures currently support migration.\n\nTo then actually import these resources into the OpenTofu state run:\n\n```shell\ntofu init # if necessary\ntofu apply\n```\n\nnoting that the plan should indicate resources will be imported.\n\nThe import blocks in the `imports.tf` file are idempotent; once the configuration\nhas been \"applied\" to import them, this file may be deleted, left in place and/or\ncommitted, it does not matter.\n\n### Development\n\n- Create a project directory with a venv.\n- Clone the repo (either inside or outside the project directory), then with the\n  venv run `pip install -e path_to_repo`.\n- Changes to the `src/` files are picked up when running `tofu-os-cfg`.\n- Note that the `--output` argument can be used to determine where files are\n  generated.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackhpc%2Ftofu-openstack-config","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstackhpc%2Ftofu-openstack-config","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackhpc%2Ftofu-openstack-config/lists"}