OpenStack

In staging and production, a request for plaintext user_data is rejected outright — the generator requires a Barbican secret reference instead, so secrets never land in an instance's metadata in cleartext.

• The endpoint picker scores Keystone catalog entries — public interfaces score higher than internal, which score higher than admin — plus a bonus for matching your configured region.
• Staging and production force image UUID pinning and reject plaintext user_data, requiring a Barbican secret reference instead.

resource "openstack_compute_instance_v2" "web" {
  name        = "web"
  flavor_name = "m1.medium"
  image_id    = var.image_id
  # user_data: rejected in staging/production, use a Barbican secret ref
}