You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "dcontiveros-nf (via GitHub)" <gi...@apache.org> on 2025/04/23 22:30:50 UTC
[D] Generating credentials prior to install for automated deployment [cloudstack]
GitHub user dcontiveros-nf created a discussion: Generating credentials prior to install for automated deployment
Hello.
I am attempting to fully automate an install of cloudstack. I have the management node fully deployed via Salt, so software dependencies are not an issue.
My main issue stems from having to rely on the GUI to "continue the install". Ideally I would like to run commands against the API to create the Zones and remaining hierarchy.
I saw another post where someone suggested using `admin/password`, but I feel that's highly insecure. Ideally, I’d like to specify a deployment token via a secrets mechanism—like a vault or key-value store—and use that for deployments and continued setup.
Is this possible? Having to use a GUI is highly irregular imo. I also open to running SQL edits as part of the setup, since our database for this is hosted on another server.
Thanks!
GitHub link: https://github.com/apache/cloudstack/discussions/10768
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
Ok so let's drill down even more:
1. Use default admin credentials to log into API
2. Use `registerUserKeys` to generate `apikey/secretkey` for my default user
3. Use these keys to generate the hosting hierarchy specific to my needs with the other API andpoints
Believe that is my plan of action. Does that sound accurate?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12937112
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
Sure, it seems valid, though I would not have an implementation strategy yet. Also I am not sure if I am missing something (cc @NuxRo @rajujith )
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12935639
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
So essentially there is no way to fully automate this in a safe manner without defaulting to creating my user post install via API. I'm wondering if I should place a feature request because not being able to automate deploys will be an issue once we start scaling.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12935284
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
I think we are getting out of sync. Let me explain my understanding:
1. when I first deploy a management node via Cloudstack, I only have admin/password default credentials
2. There is no way to modify this on install
3. I am trying to avoid the GUI to create the proper hosting hierarchy with my network info, essentially mimicking the continue installer prompts via API
I was thinking about going this route:
- Use default admin/password to log into the API credentials to create an admin user
- Create an equivalent admin user via API
- Register them with the developer API via the above endpoint (this getting the apikey/secretkey)
- Using the generated keys to create the proper hierarchy via API.
Is this an accurate procedure and also is this possible?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12936497
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
@dcontiveros-nf any updates, like
- should we create one or more issues?
- can we close this discussion?
- do you have more workarounds?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-13639484
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
about "There is no way to modify this on install” I am not sure, but your proposed procedure should work (without using the GUI).
you can alternatively
- Use default admin/password to log into the API to auth as the default admin user
- register API keys and logout (_or_/**and** change default pw on the fly)
- do the rest with API keys
if so desired:
- Create an equivalent admin user via API
- Register them with the developer API via the above endpoint (thus getting the apikey/secretkey)
- Using the generated keys from the registerUserKeys endpoint to create the proper hierarchy via API.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12936648
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
The entire point of this is to avoid using a GUI. Forcing an admin to log into a GUI to define the proper information is definitely a limiting factor in automation. I think we need to agree on the need for such a feature to make automation more manageable.
Obviously once you have privileged access, automation via API becomes much easier. Believe this is a chicken and egg problem.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12935727
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
Is there anyway to skip this wizard? I Was attempting to see how the database would look like post wizard so I can add the appropriate zones. However, I cannot get past the adding hosts part here:
For documentation purposes, I think we need a headless install option. Think my only avenue at this point is the above method, REST API interaction.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12940553
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf edited a comment on the discussion: Generating credentials prior to install for automated deployment
Ok so let's drill down even more:
1. Use default admin credentials to log into API
2. Use `registerUserKeys` to generate `apikey/secretkey` for default admin user
3. Use these keys to generate the hosting hierarchy specific to my needs with the other API andpoints
Believe that is my plan of action. I would need to get approval but at minimum I believe this should work.
Does that sound accurate?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12937112
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
@dcontiveros-nf you can call the API without loging into the GUI. see https://cloudstack.apache.org/api/apidocs-4.20/apis/registerUserKeys.html
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12936394
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf closed a discussion: Generating credentials prior to install for automated deployment
Hello.
I am attempting to fully automate an install of cloudstack. I have the management node fully deployed via Salt, so software dependencies are not an issue.
My main issue stems from having to rely on the GUI to "continue the install". Ideally I would like to run commands against the API to create the Zones and remaining hierarchy.
I saw another post where someone suggested using `admin/password`, but I feel that's highly insecure. Ideally, I’d like to specify a deployment token via a secrets mechanism—like a vault or key-value store—and use that for deployments and continued setup.
Is this possible? Having to use a GUI is highly irregular imo. I also open to running SQL edits as part of the setup, since our database for this is hosted on another server.
Thanks!
GitHub link: https://github.com/apache/cloudstack/discussions/10768
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf edited a comment on the discussion: Generating credentials prior to install for automated deployment
I think we are getting out of sync. Let me explain my understanding:
1. when I first deploy a management node via Cloudstack, I only have admin/password default credentials
2. There is no way to modify this on install
3. I am trying to avoid the GUI to create the proper hosting hierarchy with my network info, essentially mimicking the continue installer prompts via API
I was thinking about going this route:
- Use default admin/password to log into the API credentials to auth as the default admin user
- Create an equivalent admin user via API
- Register them with the developer API via the above endpoint (this getting the apikey/secretkey)
- Using the generated keys from the `registerUserKeys` endpoint to create the proper hierarchy via API.
Is this an accurate procedure and also is this possible?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12936497
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf edited a comment on the discussion: Generating credentials prior to install for automated deployment
I think we are getting out of sync. Let me explain my understanding:
1. when I first deploy a management node via Cloudstack, I only have admin/password default credentials
2. There is no way to modify this on install
3. I am trying to avoid the GUI to create the proper hosting hierarchy with my network info, essentially mimicking the continue installer prompts via API
I was thinking about going this route:
- Use default admin/password to log into the API to auth as the default admin user
- Create an equivalent admin user via API
- Register them with the developer API via the above endpoint (this getting the apikey/secretkey)
- Using the generated keys from the `registerUserKeys` endpoint to create the proper hierarchy via API.
Is this an accurate procedure and also is this possible?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12936497
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf edited a comment on the discussion: Generating credentials prior to install for automated deployment
I have a specific hierarchy I am targetting that looks pretty similar to a barebones distributed setup.
The initial bootstrapping is what we really are trying to get past.
I believe as long as I can do the following it should be fine:
- Create Zone
- Create Pod
- Create Cluster
- Join hosts to cluster
We already have the cloudstack agent deployed on all hypervisor nodes. I believe it is simply a matter of getting this configuration bootstrapped and one host joined into a cluster so we can target the other 2 hypervisor nodes. All KVM.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12947314
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
I have a specific hierarchy I am targetting that looks pretty similar to a barebones distributed setup.
The initial bootstrapping is what we really are trying to get past.
I believe as long as I can do the following it should be fine:
- Create Zone
- Create Pod
- Create Cluster
- Join hosts to cluster
We already have the cloudstack agent deployed it is simply a matter of getting this configuration bootstrapped and one host joined into a cluster so we can target the other 2 hypervisor nodes. All KVM.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12947314
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
Your plan sounds accurate. The wizard is what you should totally skip. You can do everything it does by means of APIs, in fact the whole UI is based on APIs.
Are you planning to create a host-less zone?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12943647
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf edited a comment on the discussion: Generating credentials prior to install for automated deployment
I think we are getting out of sync. Let me explain my understanding:
1. when I first deploy a management node via Cloudstack, I only have admin/password default credentials
2. There is no way to modify this on install
3. I am trying to avoid the GUI to create the proper hosting hierarchy with my network info, essentially mimicking the continue installer prompts via API
I was thinking about going this route:
- Use default admin/password to log into the API to auth as the default admin user
- Create an equivalent admin user via API
- Register them with the developer API via the above endpoint (thus getting the apikey/secretkey)
- Using the generated keys from the `registerUserKeys` endpoint to create the proper hierarchy via API.
Is this an accurate procedure and also is this possible?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12936497
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
@dcontiveros-nf , you can do most steps using an api-/secret-key pair using the API, you will have to have that generated initially. so the one first call will have to be with admin/password. Having the install script do that generation is not implemented.
The use of a vault is depending on the API client you are using. For instance in `cmk`, it would be in a (private) config file. This file can of course be generated by some external tool if you so wish.
hope this helps.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12931777
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf edited a comment on the discussion: Generating credentials prior to install for automated deployment
The entire point of this is to avoid using a GUI. Forcing an admin to log into a GUI to define the proper access is definitely a limiting factor in automation. I think we need to agree on the need for such a feature to make automation more manageable.
Obviously once you have privileged access, automation via API becomes much easier. Believe this is a chicken and egg problem.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-12935727
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland added a comment to the discussion: Generating credentials prior to install for automated deployment
@dcontiveros-nf are you satisfied you have a way forward now?
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-13002809
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Generating credentials prior to install for automated deployment [cloudstack]
Posted by "dcontiveros-nf (via GitHub)" <gi...@apache.org>.
GitHub user dcontiveros-nf added a comment to the discussion: Generating credentials prior to install for automated deployment
@DaanHoogland Let's leave this open for now. I want to ensure I can programmatically create everything and don't run into any issues, as we may have decided to utilize routed mode.
GitHub link: https://github.com/apache/cloudstack/discussions/10768#discussioncomment-13004371
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org