CloudRC Console

[jgordini]

What would you like to see added?

In the docs there should be either the default console login for an instance or a note that says that the console is not available.
https://docs.rc.uab.edu/uab_cloud/

[wwarriner]

I think I know what you're talking about, but I want to make sure. Do you mean the default credentials for the various OSes? I assume its to get "unstuck" if the SSH key doesn't work, so you need to get access through the Horizon Dashboard console for the VM. Is that right?

We used to have something in the very old (2022) FAQ addressing this. We consider VMs to be ephemeral and stateless, which is good practice for VMs. The state (scientific or "business" data) should be in a separate volume or a database.

Then if you have an "oops, no SSH access" issue, you can simply dispose of the old instance and create a new one from an image (supplying a new SSH key), or from Terraform + Ansible, or from a script. Then attach and mount the volume with the important state, and you're good to go.

If you've lost the only copy of your private key for accessing a cloud.rc virtual machine (VM), there are a few options.

Is your instance volume backed (the default behavior)?

- **No**: Then your instance is stateless and can be simply be deleted and restarted.
- **Yes**: Will your volume be deleted when the instance is deleted (not default behavior)?
    - **Yes**: Take a [snapshot](../uab_cloud/snapshots.md#creating-an-instance-snapshot) of your current instance to create an [image](../uab_cloud/snapshots.md#images-or-instance-snapshots), then [delete your instance](../uab_cloud/instance_setup_basic.md#deleting-an-instance) and [create from image](../uab_cloud/snapshots.md#creating-an-instance-from-an-image).
    - **No**: [Delete your instance](../uab_cloud/instance_setup_basic.md#deleting-an-instance) and create an instance from the existing volume.

I'm not sure I've seen this issue come up in the past few years, but I may be mistaken. I'll let my team comment on whether this comes up a lot.

All that to say, we could include this information if we had those default credentials or where to find them. I understand they change from OS version to OS version sometimes, so the table could start getting large and might require some ongoing maintenance effort. It also provides a path around the good practices of stateless VMs.

[jgordini]

Since alot of us are hybrid now I'm moving between machines and not always having my ssh keys on me.

I think I used to be able to go to the console and type u:ubuntu p:ubuntu and get in but seems to be no longer the case.
From security perspective this probably isnt great. Although having to wait till I get back to my home computer isn't perfect either.

I think the docs should say something like "bring your ssh keys with you if you are planning to work remotely and the console password doesn't exist" so people don't see that tab and think they can rely on it.

Other hosting services typically will send you the default user and password by email when you setup an instance. so you can login via the console. Maybe this solution could be implemented.

honestly I'd rather loose a day of work on a project than rebuild it in openstack and risk messing something up. But maybe other people are more comfortable with the process.

[jgordini]

here is what claude tells me about this. Not sure if this is feasable for your case:

The challenge here is that OpenStack itself does not manage or know the OS-level username and password inside the instance. That is set entirely by cloud-init on the image. So the approach is to standardize your images with a known default credential, then simply email those static values when the instance launches.

Here is the cleanest way to do this:

---

Step 1: Standardize Your Images with Known Credentials

On each image you want to support, configure cloud-init to set a known default password. Edit /etc/cloud/cloud.cfg on the image before snapshotting:

ssh_pwauth: true

chpasswd:
  expire: false
  list:
    - ubuntu:ubuntu

This ensures every instance booted from that image will have the user ubuntu with password ubuntu available at the console. Repeat this per image with the appropriate username (centos, debian, etc.).

---

Step 2: Tag Each Image with Its Default Credentials

Use Glance image properties to store the default username and password so your listener can look them up dynamically per image:

openstack image set --property default_username=ubuntu --property default_password=ubuntu <image-id>
openstack image set --property default_username=centos --property default_password=centos <centos-image-id>

---

Step 3: Update the Listener to Fetch Image Credentials

Replace the listener script at /opt/nova-mailer/listener.py with this updated version that reads the credentials from the image properties:

import oslo_messaging
import smtplib
import logging
from email.mime.text import MIMEText
from keystoneauth1.identity import v3
from keystoneauth1 import session
from keystoneclient.v3 import client as keystone_client
from novaclient import client as nova_client
from glanceclient import client as glance_client

logging.basicConfig(level=logging.INFO)
log = logging.getLogger(__name__)

KEYSTONE_AUTH_URL = "http://controller:5000/v3"
ADMIN_USER        = "admin"
ADMIN_PASSWORD    = "your_admin_password"
ADMIN_PROJECT     = "admin"

SMTP_HOST     = "smtp.example.com"
SMTP_PORT     = 587
SMTP_USER     = "noreply@example.com"
SMTP_PASSWORD = "smtp_password"
FROM_ADDRESS  = "noreply@example.com"


def get_keystone_session():
    auth = v3.Password(
        auth_url=KEYSTONE_AUTH_URL,
        username=ADMIN_USER,
        password=ADMIN_PASSWORD,
        project_name=ADMIN_PROJECT,
        user_domain_id="default",
        project_domain_id="default",
    )
    return session.Session(auth=auth)


def get_user_email(user_id):
    sess = get_keystone_session()
    ks   = keystone_client.Client(session=sess)
    user = ks.users.get(user_id)
    return getattr(user, "email", None)


def get_image_credentials(image_id):
    sess     = get_keystone_session()
    glance   = glance_client.Client("2", session=sess)
    image    = glance.images.get(image_id)
    username = image.get("default_username", "ubuntu")
    password = image.get("default_password", "ubuntu")
    return username, password


def send_email(to_address, instance_name, username, password):
    body = f"""
Hello,

Your OpenStack instance is ready and accessible via the console.

  Instance : {instance_name}
  Username : {username}
  Password : {password}

You can log in through the Horizon dashboard under:
Compute > Instances > Console

We recommend changing your password after first login.

Regards,
OpenStack Cloud Team
"""
    msg            = MIMEText(body)
    msg["Subject"] = f"Your instance '{instance_name}' console credentials"
    msg["From"]    = FROM_ADDRESS
    msg["To"]      = to_address

    with smtplib.SMTP(SMTP_HOST, SMTP_PORT) as server:
        server.starttls()
        server.login(SMTP_USER, SMTP_PASSWORD)
        server.sendmail(FROM_ADDRESS, [to_address], msg.as_string())
    log.info("Email sent to %s", to_address)


class InstanceCreateEndpoint(object):
    filter_rule = oslo_messaging.NotificationFilter(
        event_type="compute.instance.create.end"
    )

    def info(self, ctxt, publisher_id, event_type, payload, metadata):
        instance_name = payload.get("display_name", "unknown")
        user_id       = payload.get("user_id")
        image_meta    = payload.get("image_meta", {})
        image_id      = image_meta.get("base_image_ref") or payload.get("image_ref_url", "").split("/")[-1]

        if not user_id:
            log.warning("No user_id in payload, skipping")
            return

        email = get_user_email(user_id)
        if not email:
            log.warning("No email on file for user %s, skipping", user_id)
            return

        if not image_id:
            log.warning("Could not determine image_id from payload, skipping")
            return

        try:
            username, password = get_image_credentials(image_id)
        except Exception as e:
            log.error("Failed to fetch image credentials: %s", e)
            username, password = "ubuntu", "ubuntu"

        log.info("Sending console credentials for '%s' to %s", instance_name, email)
        send_email(email, instance_name, username, password)


def main():
    transport = oslo_messaging.get_notification_transport(
        oslo_messaging.get_oslo_config(),
        url="rabbit://openstack:your_rabbit_password@controller:5672/"
    )
    targets   = [oslo_messaging.Target(topic="notifications")]
    endpoints = [InstanceCreateEndpoint()]

    server = oslo_messaging.get_notification_listener(
        transport, targets, endpoints, executor="threading"
    )
    log.info("Starting Nova credential mailer listener...")
    server.start()
    server.wait()


if __name__ == "__main__":
    main()

---

Step 4: Install the Glance Client

pip install python-glanceclient

Then restart the service:

sudo systemctl restart nova-mailer

---

How It Works End to End

When a user launches an instance, Nova emits a compute.instance.create.end notification. Your listener catches it, pulls the image ID from the payload, fetches the default_username and default_password properties you tagged on that image in Glance, looks up the launching user's email from Keystone, and sends them a clean email with the console login details.

The key design decision here is storing credentials on the image via Glance properties rather than hardcoding them in your listener. This means if you add a new image with different credentials, you just tag it correctly and everything works automatically without touching the service code.