Examples and references to use Chef for OpenStack projects
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Zuul 9df3917f9b Merge "Modify tox.ini Replace openstack.org URLs with opendev.org URLs" 3 weeks ago
.chef Convert provisioning recipes to cookbook 3 years ago
.delivery Use Chef Delivery to run verification tests 11 months ago
data_bags Add ironic to integration 9 months ago
deploy-guide/source Build a deploy-guide 2 months ago
doc Build a deploy-guide 2 months ago
environments Updates for Rocky deployment 2 months ago
playbooks OpenDev Migration Patch 2 months ago
roles Update the example roles and AIO Kitchen scenario 6 months ago
scripts Use Chef Delivery to run verification tests 11 months ago
test/tempest/default Finalize the move from openstack-chef-repo to openstack-chef 10 months ago
tools Finalize the move from openstack-chef-repo to openstack-chef 10 months ago
.gitignore Add .idea/* and .venv/ in .gitignore 1 month ago
.gitreview OpenDev Migration Patch 2 months ago
.kitchen.dokken.yml Support Chef 14 in Test Kitchen scenarios 1 year ago
.kitchen.multi.yml Use CentOS 7.5 for test-kitchen 11 months ago
.kitchen.yml Updates for Rocky deployment 2 months ago
.rubocop.yml Refactored provisioning cookbook for Ocata, ChefDK updates 1 year ago
.rubocop_todo.yml Updated integration attributes and methods 1 year ago
.zuul.yaml Merge "Build a deploy-guide" 2 months ago
Berksfile use cookbook-openstackclient from official openstack git tree 8 months ago
CONTRIBUTING.md Updated the contrib docs 1 year ago
LICENSE Apache License v2.0 6 years ago
README.md Updates for Rocky deployment 2 months ago
Rakefile Update cookbook references for berkshelf 1 year ago
TESTING.md Removed Spiceweasel 4 years ago
bindep.txt Implement native zuul v3 tests 1 year ago
bootstrap.sh fix recipe order for allinone role and bootstrap.sh 3 years ago
setup.cfg Change openstack-dev to openstack-discuss 6 months ago
setup.py update setup.py to use multiprocessing, pbr version constraints 10 months ago
tox.ini Modify tox.ini 1 month ago


Team and repository tags

Team and repository tags

Chef OpenStack Logo

Testing framework for deploying OpenStack using Chef

This is the testing framework for OpenStack deployed using Chef. We leverage this to test against our changes to our cookbooks to make sure that you can still build a cluster from the ground up with any changes we introduce.

This framework also gives us an opportunity to show different Reference Architectures and a sane example on how to start with OpenStack using Chef.

With the master branch of the cookbooks, which is currently tied to the base OpenStack Rocky release, this supports deploying to Ubuntu 18.04 and CentOS 7 in monolithic, or allinone, and non-HA multinode configurations with Neutron. The cookbooks support a fully HA configuration, but we do not test for that as there are far numerous paths to HA.


Getting the Code (this repo)

$ git clone https://github.com/openstack/openstack-chef.git
$ cd openstack-chef

The OpenStack cookbooks by default use encrypted data bags for configuring passwords. There are four data bags : user_passwords, db_passwords, service_passwords, secrets. There already exists a data_bags/ directory, so you shouldn’t need to create any for a proof of concept. If you do, something is wrong. See the Data Bags doc for the gory details.

Supported Deployments

For each deployment model, there is a corresponding file in the doc/ directory. Please review that for specific details and additional setup that might be required before deploying the cloud.

Kitchen Deploy Commands

These commands will produce various OpenStack cluster configurations, the simplest being a monolithic Compute Controller with Neutron (allinone). These deployments are not intended to be production-ready, and will need adaptation to your environment. This is intended for development and proof of concept deployments.

Kitchen Test Scenarios

Initialize the ChefDK

$ eval "$(chef shell-init bash)"

Everything self-contained (allinone)

# allinone with Neutron
$ kitchen test [centos|ubuntu]

Access the machine

$ kitchen login [centos|ubuntu]
$ sudo su -

Multiple nodes (non-HA)

# Multinode with Neutron (1 controller + 2 compute nodes)
$ export KITCHEN_YAML=.kitchen.multi.yml
$ kitchen converge [centos|ubuntu|all]
$ kitchen verify [centos|ubuntu|all]
$ kitchen destroy [centos|ubuntu|all]

Access the Controller

$ kitchen login controller-[centos|ubuntu]
$ sudo su -

Access the Compute nodes

$ cd vms
$ kitchen login compute1
# OR
$ kitchen login compute2
$ sudo su -

Testing The Controller

# Access the controller as noted above
$ source /root/openrc
$ nova --version
$ openstack service list && openstack hypervisor list
$ openstack image list
$ openstack user list
$ openstack server list

Working With Security Groups

To allow SSH access to instances, a security group is defined as follows:

$ openstack security group list
$ openstack security group list default
$ openstack security group create allow_ssh --description "allow ssh to instances"
$ openstack security group rule create allow_ssh --protocol tcp --dst-port 22:22 --remote-ip
$ openstack security group list allow_ssh

Working With Keys

To allow SSH keys to be injected into instance, a key pair is defined as follows:

# generate a new key pair
$ openstack keypair create mykey > mykey.pem
$ chmod 600 mykey.pem
$ openstack keypair create --public-key ~/.ssh/id_rsa.pub mykey
# verify the key pair has been imported
$ openstack keypair list

Booting up a cirros image on the Controller

$ openstack server create --flavor 1 --image cirros --security-group allow_ssh --key-name mykey test

Wait a few seconds and the run openstack server list if Status is not Active, wait a few seconds and repeat.

Once status is active you should be able to log in using SSH, or vagrant ssh <vm_name>

$ ssh cirros@<ip address from openstack server list output>

Accessing The OpenStack Dashboard

If you would like to use the OpenStack dashboard you should go to https://localhost:9443 and the username and password is admin/mypass.

Verifying OpenStack With Tempest

If you log in to the controller machine you can test via the most recent Tempest release.

$ cd vms
$ vagrant ssh <controller>
$ sudo su -
root@controller:~ cd /opt/tempest
root@controller:/opt/tempest$ ./run_tempest.sh -V --smoke --serial

[-- snip --]

    test_pretty_tox                                                       1.68
    test_pretty_tox_fails                                                 1.03
    test_pretty_tox_serial                                                0.61
    test_pretty_tox_serial_fails                                          0.55

Ran 233 tests in 13.869s

Running flake8 ...


To remove all the nodes and start over again with a different environment or different environment attribute overrides, using the following rake command.

$ chef exec rake destroy_machines

To refresh all cookbooks, use the following commands.

$ rm -rf cookbooks
$ chef exec rake berks_vendor

To clean up everything, use the following rake command.

$ chef exec rake clean


See the doc/tools.md for more information.

Data Bags

Some basic information about the use of data bags within this repo.

# Show the list of data bags
$ chef exec knife data bag list -z

# Show the list of data bag items
$ chef exec knife data bag show db_passwords -z

# Show contents of data bag item
$ chef exec knife data bag show db_passwords nova -z
Encrypted data bag detected, decrypting with provided secret.
nova: mypass
id:   nova

# Update contents of data bag item
# set EDITOR env var to your editor. eg. EDITOR=vi
$ chef exec knife data bag edit secrets dispersion_auth_user -z

Data Bag Default Values

db_passwords are set to “mypass” secrets are set to “_token” service_passwords are set to “mypass” user_passwords are set to “mypass”

Default Encrypted Data Bag Secret

The default secret is stored here .chef/encrypted_data_bag_secret and referenced by .chef/knife.rb.

When we say defaults, we mean that they are known by everyone with access to this repository. Change these to something else before deploying for real.

Known Issues and Workarounds

Windows Platform

When using this on a Windows platform, here are some tweaks to make this work:

  • In order to get SSH to work, you will need an SSL client installed. You can use the one that comes with Git for Windows. You will need to append C:\Program Files (x86)\Git\bin; to the system PATH.


  • Support for floating IPs
  • Better instructions for multi-node network setup
  • Easier debugging. Maybe a script to pull the logs from the controller.


Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at


Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.