Providers
OpenStack
CL4–5Connects via a Keystone token — application credential or password — with a 25-second timeout. Covers Nova, Neutron, Cinder, Glance, Swift, Designate, Barbican, Octavia, and Heat.
In staging and production, a request for plaintext user_data is rejected outright — the generator requires a Barbican secret reference instead, so secrets never land in an instance's metadata in cleartext.
- The endpoint picker scores Keystone catalog entries — public interfaces score higher than internal, which score higher than admin — plus a bonus for matching your configured region.
- Staging and production force image UUID pinning and reject plaintext user_data, requiring a Barbican secret reference instead.
Capability maturity
- FinOps (cost sync)
- Drift detection
- Day-2 operations
- Brownfield import
- AI copilot
What NebulaStack actually generates for OpenStack
OpenStack is NebulaStack's sovereign-cloud provider: generation covers Nova, Neutron, Cinder, Glance, Swift, Designate, Barbican, Aodh, and Octavia surfaces, with live inventory sync and CloudKitty chargeback FinOps.
A minimal real resource
resource "openstack_compute_instance_v2" "web" {
name = "web"
flavor_name = "m1.medium"
image_id = var.image_id
# user_data: rejected in staging/production, use a Barbican secret ref
}Under the hood
- backend/src/services/iac/openstack/**
- backend/src/services/openstack/**