Authenticate with openrc or clouds.yaml

The CLI reads credentials from environment variables. You can set them in an openrc file for the current shell, or keep them in clouds.yaml and select a cloud with --os-cloud.

openrc

cat > ~/.config/vietnix/openrc <<'EOF'
export OS_AUTH_URL=https://auth.vietnix.cloud:5000/v3
export OS_USERNAME="<username>"
export OS_PASSWORD="<password>"
export OS_USER_DOMAIN_NAME="<domain>"
export OS_PROJECT_NAME="<project>"
export OS_PROJECT_DOMAIN_NAME="<domain>"
export OS_IDENTITY_API_VERSION=3
EOF

chmod 600 ~/.config/vietnix/openrc
. ~/.config/vietnix/openrc
openstack token issue

clouds.yaml

The client reads clouds.yaml from the current directory, ~/.config/openstack/, or /etc/openstack/.

clouds:
  vietnix:
    auth:
      auth_url: https://auth.vietnix.cloud:5000/v3
      username: "<username>"
      password: "<password>"
      project_name: "<project>"
      user_domain_name: "<domain>"
      project_domain_name: "<domain>"
    identity_api_version: 3

openstack --os-cloud vietnix token issue
openstack --os-cloud vietnix server list

Project and domain

Most commands are scoped to one project. OS_PROJECT_NAME selects the project, and the two domain values tell Keystone where the user and the project live. If you do not know them, ask Vietnix or read them from the console account page.

To check which project a token belongs to:

openstack token issue -f json
openstack project show "$OS_PROJECT_NAME"

Credential hygiene

• Keep openrc and clouds.yaml at mode 600, outside the repository.
• Do not put a password in a CI job definition. Use a secret store and inject the environment variables at runtime.
• If the account enforces 2FA, use an application credential or a service account instead of a password.
• Rotate the credential when a laptop or CI runner is lost.

Related

The API reference documents the same Keystone flow: Authentication.