Chef Cookbook - common OpenStack configuration
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Lance Albertson cb78508489 Update to Chef Workstation 21.2.303 7 months ago
.delivery Stein fixes 2 years ago
attributes Merge "Add load-balancer service" 10 months ago
libraries Cookstyle 6.19.5 fixes 12 months ago
recipes Cookstyle 6.19.5 fixes 12 months ago
resources Adds provides method to define name of resources 1 year ago
spec Cookstyle 6.19.5 fixes 12 months ago
templates/default Make configuration files more readable 4 years ago
.gitignore add a Rakefile to structure test runs 7 years ago
.gitreview OpenDev Migration Patch 2 years ago
.rubocop.yml Updates for Train 1 year ago
.rubocop_todo.yml Update to Chef Workstation 21.2.303 7 months ago
.zuul.yaml Rename openstack-chef-repo references to openstack-chef 3 years ago
Berksfile Set Berksfile to use ruby solver 2 years ago Workflow documentation is now in infra-manual 7 years ago
LICENSE Initial commit 9 years ago
README.rst Update to Chef Workstation 21.2.303 7 months ago
Rakefile Stein fixes 2 years ago Sync stackforge/cookbook* to openstack/cookbook* for common cookbook 6 years ago
metadata.rb Adds provides method to define name of resources 1 year ago


OpenStack Chef Cookbook - common



This cookbook provides common setup recipes, helper methods and attributes that describe an OpenStack deployment as part of the OpenStack reference deployment Chef for OpenStack.

Please relate to the official OpenStack Configuration and Installation Guides for a more detailed documentation on operating and administration of an OpenStack cluster:


  • Chef 15 or higher
  • Chef Workstation 21.2.303 for testing (also includes berkshelf for cookbook dependency resolution)


  • ubuntu
  • redhat
  • centos


The following cookbooks are dependencies:

  • 'etcd', '~> 5.6'
  • 'mariadb', '~> 4.0'
  • 'memcached', '~> 6.0'
  • 'selinux'
  • 'yum-epel'


Please see the extensive inline documentation in attributes/*.rb for descriptions of all the settable attributes for this cookbook.

Note that all attributes are in the default["openstack"] "namespace"

Attributes to generate OpenStack service configuration files

Since the mitaka release, we moved to a completely new way to generate all OpenStack service configuration files. The base template is the openstack-service.conf.erb included in the templates of this cookbook. In each of the service cookbook (e.g. openstack-network, openstack-identity or openstack-compute), the service configuration file (e.g neutron.conf, keystone.conf or nova.conf) gets generated directly from attributes set inside the cookbook. To merge all the configuration options (including the secrets) properly, before handing them over as @service_config to the mentioned template above, we use the methods defined in libraries/config_helpers.

For examples how to use these attributes, please refer to the attribute files included in the service cookbooks (e.g. attributes/neutron_conf.rb in openstack-network or attributes/keystone_conf.rb in openstack-identity). The basic structure of all these attributes always follows this model:



  • Install the common python openstack client package


  • Install bash completions for openstack client


  • Installs/Configures common recipes


  • Installs and starts etcd


  • Installs/Configures common logging


  • Iterates over the contents of the node['openstack']['sysctl'] hash and executes the sysctl resource.

Data Bags

This cookbook contains Libraries to work with passwords and secrets in databags. Databags can be unencrypted (for dev) or encrypted (for prod). In addition to traditionally encrypted data bags they can also be created as chef-vault items. To read more about chef-vault and how to use it, go to

Documentation for Attributes for selecting databag format can be found in the attributes section of this cookbook.

Documentation for format of these Databags can be found in the Openstack Chef Repo repository.


This cookbook provides the openstack_database custom resource. When this cookbook is included as dependency, this custom resource can be used to create databases needed by the OpenStack services.

An example of the usage can be seen here .


This cookbook exposes a set of default library routines:

  • cli -- Used to call openstack CLIs
  • endpoint -- Used to return a ::URI object representing the named OpenStack endpoint
  • internal_endpoint -- Used to return a ::URI object representing the named OpenStack internal endpoint if one was specified. Otherwise, it will return the same value as endpoint.
  • public_endpoint -- Used to return a ::URI object representing the named OpenStack public endpoint if one was specified. Otherwise, it will return the same value as endpoint.
  • endpoints -- Useful for operating on all OpenStack endpoints
  • db -- Returns a Hash of information about a named OpenStack database
  • db_uri -- Returns the SQLAlchemy RFC-1738 DB URI (see: for a named OpenStack database
  • secret -- Returns the value of an encrypted data bag for a named OpenStack secret key and key-section
  • get_password -- Ease-of-use helper that returns the decrypted password for a named database, service or keystone user.
  • matchers -- A custom matcher(render_config_file) for testing ini format file section content by with_section_content.


The following are code examples showing the above library routines in action. Remember when using the library routines exposed by this library to include the Openstack routines in your recipe's ::Chef::Recipe namespace, like so:

Example of using the endpoint routine:

Example of using the get_password and db_uri routine:

URI Operations

Use the Openstack::uri_from_hash routine to helpfully return a ::URI::Generic object for a hash that contains any of the following keys:

  • host
  • uri
  • port
  • path
  • scheme

If the uri key is in the hash, that will be used as the URI, otherwise the URI will be constructed from the various parts of the hash corresponding to the keys above.

The routine will return nil if neither a uri or host key exists in the supplied hash.

Using the library without prefixing with ::Openstack

Don't like prefixing calls to the library's routines with ::Openstack? Do this:

in your recipe.

License and Author

Author Jay Pipes (
Author John Dewey (
Author Matt Ray (
Author Craig Tracey (
Author Sean Gallagher (
Author Ionut Artarisi (
Author Chen Zhiwei (
Author Brett Campbell (
Author Mark Vanderwiel (
Author Jan Klare (
Author Christoph Albers (
Author Jens Harbott (
Author Lance Albertson (
Copyright Copyright (c) 2012-2013, AT&T Services, Inc.
Copyright Copyright (c) 2013, Opscode, Inc.
Copyright Copyright (c) 2013, Craig Tracey
Copyright Copyright (c) 2013-2014, SUSE Linux GmbH
Copyright Copyright (c) 2013-2015, IBM, Corp.
Copyright Copyright (c) 2013-2014, Rackspace US, Inc.
Copyright Copyright (c) 2016-2019, x-ion GmbH
Copyright Copyright (c) 2016-2020, Oregon State University

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.