# Change OpenStack modules to read credentials from environment if not in parameters?

**URL:** <https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094>\
**Category:** Ansible Project\
**Created:** [July 10, 2013, 8:24am UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094 "2013-07-10T08:24:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darragh\_O\_Reilly](https://avatars.discourse-cdn.com/v4/letter/d/71c47a/32.png) [@Darragh\_O\_Reilly](https://forum.ansible.com/u/Darragh_O_Reilly)\
**Post date:** [July 10, 2013, 8:24am UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/1 "2013-07-10T08:24:42Z")

</div>

Today you have to specify user/password/tenant/url with every task. It would be nice if the modules could read these from the environment instead - it would make playbooks more concise. The EC2 module checks the environment if they are not passed as parameters.

The quantum CLI reads these:

$ quantum --help | grep Env  
Authentication strategy (Env: OS\_AUTH\_STRATEGY,  
Authentication URL (Env: OS\_AUTH\_URL)  
Authentication tenant name (Env: OS\_TENANT\_NAME)  
Authentication username (Env: OS\_USERNAME)  
Authentication password (Env: OS\_PASSWORD)  
Authentication region name (Env: OS\_REGION\_NAME)

Let me know if this would be accepted, before I start working on a patch.

---

<div class="post-metadata">

**Author:** ![GW1](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@GW1](https://forum.ansible.com/u/GW1)\
**Post date:** [July 10, 2013, 9:09am UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/2 "2013-07-10T09:09:11Z")

</div>

Hi,

Just as a note that this can already be done simply by:

```auto
quantum_network: state=present login_username={{ lookup_plugin('env', 'OS_USERNAME') }} login_password={{ lookup_plugin('env', 'OS_PASSWORD') }}

```

Greetings,  
gw

---

<div class="post-metadata">

**Author:** ![Darragh\_O\_Reilly](https://avatars.discourse-cdn.com/v4/letter/d/71c47a/32.png) [@Darragh\_O\_Reilly](https://forum.ansible.com/u/Darragh_O_Reilly)\
**Post date:** [July 10, 2013, 9:31am UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/3 "2013-07-10T09:31:14Z")

</div>

hi,

thanks - but that’s very long (and still needs login\_tenant\_name), and it has lots of brackets etc, and you would need it with every task. I think this looks better:

quantum\_network: name=net1  
quantum\_subnet: name=sub1 network\_name=net1 cidr=172.17.17.0/24

…

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [July 10, 2013, 11:23am UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/4 "2013-07-10T11:23:47Z")

</div>

It’s much shorter if you save those to variables:

vars:  
username = “{{ lookup(‘env’, ‘OS\_USERNAME’) }}”

Also I should point out it is “lookup” not “lookup\_plugin”.

I think there are plenty of reasons to not read this from the environment since you might be logging in as root or bob and needing a username of “openstack”.

However having it default to the current user in the module if not provided I am totally good with, I’d gladly expect a patch that made this happen for all of openstack\_\*, though we would also want  
to make sure we tested all of the playbook in [github.com/ansible](http://github.com/ansible) to make sure it was good.

Thanks!

–Michael

---

<div class="post-metadata">

**Author:** ![Darragh\_O\_Reilly](https://avatars.discourse-cdn.com/v4/letter/d/71c47a/32.png) [@Darragh\_O\_Reilly](https://forum.ansible.com/u/Darragh_O_Reilly)\
**Post date:** [July 10, 2013, 12:51pm UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/5 "2013-07-10T12:51:13Z")

</div>

of course it would be optional - just like it is with EC2:  
[https://github.com/ansible/ansible/blob/v1.2/library/cloud/ec2#L255](https://github.com/ansible/ansible/blob/v1.2/library/cloud/ec2#L255)

The easiest (and fastest) way would be to put the vars in the local environment and use local\_action:

local\_action: quantum\_network name=net1

This change would only affect the OpenStack modules. Which playbook would need to be tested?

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [July 10, 2013, 2:13pm UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/6 "2013-07-10T14:13:00Z")

</div>

Here’s the main one we have:

[https://github.com/ansible/ansible-redhat-openstack](https://github.com/ansible/ansible-redhat-openstack)

(Upgrades to it are welcome!)

---

<div class="post-metadata">

**Author:** ![Darragh\_O\_Reilly](https://avatars.discourse-cdn.com/v4/letter/d/71c47a/32.png) [@Darragh\_O\_Reilly](https://forum.ansible.com/u/Darragh_O_Reilly)\
**Post date:** [July 10, 2013, 2:46pm UTC](https://forum.ansible.com/t/change-openstack-modules-to-read-credentials-from-environment-if-not-in-parameters/13094/7 "2013-07-10T14:46:42Z")

</div>

grand - I’ll see if I can get that going on vagrant/virtualbox first. I have been meaning to try it anyway.