OPCP - How to use Terraform

Objective

Terraform is an open source Infrastructure as Code (IaC) tool developed by HashiCorp. It allows you to describe and provision your infrastructure declaratively from configuration files written in HashiCorp Configuration Language (HCL).

Since the OPCP offer is based on OpenStack, you can use the Terraform OpenStack provider to automate the deployment of your resources: instances, networks, volumes, key pairs, etc.

This guide details the steps required to generate an Application Credential from Horizon, configure Terraform and deploy a first server on your OPCP infrastructure.

Requirements

• An active OPCP service.
• A user account with sufficient rights to log in to Horizon on the OPCP offer.
• Terraform installed (version >= 1.0) or OpenTofu on your workstation.
• An SSH key pair on your local workstation to access your instance.
• A private network previously created in your OPCP project (see the guide How to install an instance from the Horizon interface).

Table of Contents

• 1. Creating an Application Credential from Horizon
• 2. Preparing the Terraform environment
• 3. Creating a server
• 4. Additional node-level configurations (RAID, LACP)
• 5. Removing the infrastructure
• 6. Troubleshooting
• 7. References

Instructions

1. Creating an Application Credential from Horizon

To allow Terraform to communicate with your OPCP infrastructure, you need to generate an Application Credential pair (id / secret) from the Horizon interface. This mechanism avoids using your Keycloak credentials directly and provides dedicated authentication for your automation workflows, with a permissions scope limited to the current project.

Logging in to Horizon

Log in to the Horizon interface of your OPCP environment, then select the project in which you want to deploy your resources via Terraform. For more information, refer to the Getting started with your OPCP guide.

Creating the Application Credential

In the left-hand menu, click on Identity, then on Application Credentials.

Click on + Create Application Credential.

Fill in the following fields:

Click on Create Application Credential.

2. Preparing the Terraform environment

Creating the working directory

Create a directory dedicated to your Terraform project:

mkdir terraform-opcp && cd terraform-opcp

Defining the OpenStack provider

In a file named provider.tf, add the following lines:

terraform {
  required_version = ">= 1.0"
  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = ">= 3.0.0"
    }
  }
}

provider "openstack" {
  
}

No parameters are required in the provider block: the OpenStack provider automatically retrieves the authentication information from the OS_* environment variables.

Loading OpenStack environment variables

When you created your Application Credential, Horizon offered to download a clouds.yaml or openrc file. The simplest approach is to source this openrc.sh file in your shell before running Terraform:

source openrc.sh

Initialisation

Download the OpenStack provider plugins:

terraform init

3. Creating a server

In a main.tf file, declare the resources required to create an instance attached to an existing private network:

# Variables related to the instance
variable "instance_name" {
  description = "Name of the instance that will be created in OPCP"
  type        = string
  default     = "instance-terraform-name"
}

variable "image_name" {
  description = "Name of the image to use for the instance (e.g.: Debian 12 OPCP)"
  type        = string
  default     = "Debian 12 OPCP"
}

variable "flavor_name" {
  description = "Baremetal flavor defining the hardware resources of the instance (e.g.: scale-1, scale-2, etc.)"
  type        = string
  default     = "scale-1"
}

variable "network_name" {
  description = "Name of the existing network to which the instance will be attached"
  type        = string
  default     = "<your-network-name>"
}

variable "key_name" {
  description = "Name of the SSH key pair to associate with the instance"
  type        = string
  default     = "terraform-key"
}

# Creating an instance
resource "openstack_compute_instance_v2" "terraform_instance" {
  name        = var.instance_name
  image_name  = var.image_name
  flavor_name = var.flavor_name
  key_pair    = var.key_name

  network {
    name = var.network_name
  }

  lifecycle {
    # Prevents Terraform from detecting drift when the base image is updated
    ignore_changes = [
      image_name
    ]
  }

  # Useful metadata
  metadata = {
    environment = "production"
    managed_by  = "terraform"
  }

  # Longer timeouts (baremetal provisioning is slow)
  timeouts {
    create = "60m"
    delete = "30m"
  }
}

# Useful outputs after creation
output "instance_id" {
  value = openstack_compute_instance_v2.terraform_instance.id
}

output "instance_ip" {
  value = openstack_compute_instance_v2.terraform_instance.access_ip_v4
}

Reviewing the plan

Before any deployment, preview the actions that will be performed:

terraform plan

Applying the configuration

Deploy the instance with the following command:

terraform apply

Confirm with yes when Terraform asks you to. Once the creation is complete, the instance is visible in the Horizon interface, in the Compute > Instances section.

4. Additional node-level configurations (RAID, LACP)

Some configurations must be applied on the baremetal node before deploying the instance and are not covered by the Terraform OpenStack provider. They require admin Ironic rights (or nodes transferred to your project) and must be performed via the OpenStack CLI.

5. Removing the infrastructure

To delete all resources created via Terraform:

terraform destroy

6. Troubleshooting

7. References

• Official Terraform documentation
• Official OpenTofu documentation
• Terraform OpenStack provider
• openstack_compute_instance_v2 resource
• OpenStack Application Credentials

Go further

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analyzed by our experts.

Join our community of users.