Application Credentials

The noris Sovereign Cloud (nSC)‘s OpenStack Application Credentials enable users to create credentials specifically for their applications without exposing their personal user passwords.

Getting started

Creating application credentials

1. In the web interface, head to Project → Identity → Application Credentials. For NBG, the direct link is dashboard.nbg.nsc.noris.cloud/identity/application_credentials.
2. Double-check the Project ID at the top, it’s important that application credentials are created for the correct project.
3. Create a new application credential: click the “Create Application Credential” button.
4. Fill in details such as the credential name (required), description, expiration date and time, roles to assign, and any access restrictions (see ACLs below).
5. Download the resulting clouds.yaml. This secret is only displayed once.
6. Place this file in ~/.config/openstack/clouds.yaml.
7. You will likely also need to set the environment variable OS_CLOUD: export OS_CLOUD=openstack
8. Your CLI should now be able to list your projects: openstack project list

Important caveats

• Users can assign specific roles and permissions (see ACLs below) to application credentials, limiting the application’s access to what is strictly necessary.
• Application credentials are linked to the user who created them, if the user is removed or loses access, the credentials will stop working.
• Each application credential is scoped to a single project, so switching projects requires a different credential for each.
• The dashboard will only list application credentials created by yourself, not every credential present for the project.
• By default, for security reasons, application credentials are forbidden from being used to create additional application credentials, Keystone trusts, or EC2 credentials. If you intend to use S3, you need EC2 credentials; enable Unrestricted on the application credentials used for this purpose. Otherwise, Unrestricted should not be enabled, as it removes these security restrictions.

ACLs

You are able to restrict the permissions of your application credentials. For example, an application used for VM management can be prevented from changing networking setups.

Example ACLs for VM management

[
  { "path": "/v2.1/servers", "method": "GET", "service": "compute" },
  { "path": "/v2.1/servers/detail", "method": "GET", "service": "compute" },
  { "path": "/v2.1/servers", "method": "POST", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}", "method": "GET", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}", "method": "PUT", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}", "method": "DELETE", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}/action", "method": "POST", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}/remote-consoles", "method": "POST", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}/diagnostics", "method": "GET", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}/os-volume_attachments", "method": "GET", "service": "compute" },
  { "path": "/v2.1/servers/{server_id}/os-volume_attachments/{volume_id}", "method": "GET", "service": "compute" },
  { "path": "/v2.1/flavors", "method": "GET", "service": "compute" },
  { "path": "/v2.1/flavors/detail", "method": "GET", "service": "compute" },
  { "path": "/v2.1/flavors/{flavor_id}", "method": "GET", "service": "compute" },
  { "path": "/v2.1/os-keypairs", "method": "GET", "service": "compute" },
  { "path": "/v2.1/os-keypairs", "method": "POST", "service": "compute" },
  { "path": "/v2.1/os-keypairs/{keypair_name}", "method": "GET", "service": "compute" },
  { "path": "/v2.1/os-keypairs/{keypair_name}", "method": "DELETE", "service": "compute" }
]

Example configuration for image management

[
  { "path": "/v2/images", "method": "POST", "service": "image" },
  { "path": "/v2/images", "method": "GET", "service": "image" },
  { "path": "/v2/images/{image_id}", "method": "GET", "service": "image" },
  { "path": "/v2/images/{image_id}", "method": "PATCH", "service": "image" },
  { "path": "/v2/images/{image_id}", "method": "DELETE", "service": "image" },
  { "path": "/v2/images/{image_id}/actions/deactivate", "method": "POST", "service": "image" },
  { "path": "/v2/images/{image_id}/actions/reactivate", "method": "POST", "service": "image" },
  { "path": "/v2/images/{image_id}/file", "method": "PUT", "service": "image" },
  { "path": "/v2/images/{image_id}/file", "method": "GET", "service": "image" },
  { "path": "/v2/images/{image_id}/members", "method": "POST", "service": "image" },
  { "path": "/v2/images/{image_id}/members", "method": "GET", "service": "image" },
  { "path": "/v2/images/{image_id}/members/{member_id}", "method": "GET", "service": "image" },
  { "path": "/v2/images/{image_id}/members/{member_id}", "method": "PUT", "service": "image" },
  { "path": "/v2/images/{image_id}/members/{member_id}", "method": "DELETE", "service": "image" },
  { "path": "/v2/images/{image_id}/tags/{tag}", "method": "PUT", "service": "image" },
  { "path": "/v2/images/{image_id}/tags/{tag}", "method": "DELETE", "service": "image" }
]

Example configuration for network management

[
  { "path": "/v2.0/networks", "method": "GET", "service": "network" },
  { "path": "/v2.0/networks", "method": "POST", "service": "network" },
  { "path": "/v2.0/networks/{network_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/networks/{network_id}", "method": "PUT", "service": "network" },
  { "path": "/v2.0/networks/{network_id}", "method": "DELETE", "service": "network" },
  { "path": "/v2.0/subnets", "method": "GET", "service": "network" },
  { "path": "/v2.0/subnets", "method": "POST", "service": "network" },
  { "path": "/v2.0/subnets/{subnet_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/subnets/{subnet_id}", "method": "PUT", "service": "network" },
  { "path": "/v2.0/subnets/{subnet_id}", "method": "DELETE", "service": "network" },
  { "path": "/v2.0/security-group-rules", "method": "GET", "service": "network" },
  { "path": "/v2.0/security-group-rules", "method": "POST", "service": "network" },
  { "path": "/v2.0/security-group-rules/{security_group_rule_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/security-group-rules/{security_group_rule_id}", "method": "DELETE", "service": "network" },
  { "path": "/v2.0/security-groups", "method": "GET", "service": "network" },
  { "path": "/v2.0/security-groups", "method": "POST", "service": "network" },
  { "path": "/v2.0/security-groups/{security_group_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/security-groups/{security_group_id}", "method": "PUT", "service": "network" },
  { "path": "/v2.0/security-groups/{security_group_id}", "method": "DELETE", "service": "network" },
  { "path": "/v2.0/ports/{port_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/ports/{port_id}", "method": "PUT", "service": "network" },
  { "path": "/v2.0/ports/{port_id}", "method": "DELETE", "service": "network" },
  { "path": "/v2.0/ports", "method": "GET", "service": "network" },
  { "path": "/v2.0/ports", "method": "POST", "service": "network" },
  { "path": "/v2.0/ports/{port_id}/add_allowed_address_pairs", "method": "PUT", "service": "network" },
  { "path": "/v2.0/ports/{port_id}/remove_allowed_address_pairs", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers", "method": "GET", "service": "network" },
  { "path": "/v2.0/routers", "method": "POST", "service": "network" },
  { "path": "/v2.0/routers/{router_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/routers/{router_id}", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}", "method": "DELETE", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/add_router_interface", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/remove_router_interface", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/add_extraroutes", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/remove_extraroutes", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/add_external_gateways", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/update_external_gateways", "method": "PUT", "service": "network" },
  { "path": "/v2.0/routers/{router_id}/remove_external_gateways", "method": "PUT", "service": "network" },
  { "path": "/v2.0/floatingips", "method": "GET", "service": "network" },
  { "path": "/v2.0/floatingips", "method": "POST", "service": "network" },
  { "path": "/v2.0/floatingips/{floatingip_id}", "method": "GET", "service": "network" },
  { "path": "/v2.0/floatingips/{floatingip_id}", "method": "PUT", "service": "network" },
  { "path": "/v2.0/floatingips/{floatingip_id}", "method": "DELETE", "service": "network" }
]

Comprehensive example

A comprehensive configuration that includes VM management, image management, and network management:

• Name: Comprehensive-Management-Credential
• Description: Credential for managing VM states, images, and networks
• Secret: (generated or provided)
• Expiration Date/Time: (optional)
• Roles: admin (or multiple specified roles such as vm_admin, image_admin, network_admin)
• Access Rules: the union of all ACL entries listed in the three examples above

Additional information

• OpenStack Application Credentials documentation
• Compute Service API reference
• Image Service API reference
• Networking Service API reference

Consulting recent large language models may also provide decent ACLs, although they should be verified for correctness before implementation.