waldur-site-agent-openstack

OpenStack Keystone plugin for waldur-site-agent. It synchronizes users and projects between Waldur and OpenStack Keystone in real time.

Status: Under active development.

What it does

• Creates/deletes OpenStack projects when Waldur resources are provisioned or terminated
• Adds/removes users in OpenStack projects based on Waldur team membership events
• Generates OpenStack usernames from user emails (local part before @)
• Supports project enable/disable (downscale/pause/restore)

Requirements

• Python 3.9+
• waldur-site-agent >= 0.7.8
• python-keystoneclient >= 5.0.0
• Admin access to OpenStack Keystone API v3

Installation

git clone <repository-url>
cd openstack_waldur_site_agent

uv venv && source .venv/bin/activate

# Install the plugin in editable mode
uv pip install -e .

# Install waldur-site-agent
uv pip install git+https://github.com/waldur/waldur-site-agent.git@main

Verify the plugin is discovered:

python -c "from importlib.metadata import entry_points; print([ep.name for ep in entry_points(group='waldur_site_agent.backends')])"
# Expected: ['openstack']

You can also execute the init script:

./test-plugin.sh

Configuration

Use test.env and test-config.yaml as a starting point. The critical section is backend_settings:

offerings:
  - name: "openstack offering"
    waldur_api_url: "${WALDUR_API_URL}"
    waldur_api_token: "${WALDUR_API_TOKEN}"
    waldur_offering_uuid: "${WALDUR_OFFERING_UUID}"

    backend_type: "openstack"
    membership_sync_backend: "openstack"
    order_processing_backend: "openstack"

    backend_settings:
      auth_url: "${OPENSTACK_AUTH_URL}"
      username: "${OPENSTACK_USERNAME}"
      password: "${OPENSTACK_PASSWORD}"
      project_name: "${OPENSTACK_PROJECT_NAME}"
      user_domain_name: "Default"
      project_domain_name: "Default"
      default_role: "_member_"
      create_users_if_not_exist: true
      verify_ssl: true   # or path to a CA bundle

    stomp_enabled: true
    stomp_host: "waldur.example.com"
    stomp_port: 61613
    stomp_username: "agent"
    stomp_password: "${STOMP_PASSWORD}"

Copy test.env, fill in your values, then export them before running.

Running

# Event-driven (recommended)
waldur-site-agent run --mode event-process --config config-file.yaml #config file can be generated by the script test-plugin.sh

# Periodic sync (useful for reconciliation)
waldur-site-agent run --mode membership-sync --config test-config.yaml

Project structure

waldur_site_agent_openstack/
├── backends.py          # OpenStackBackend + OpenStackUsernameManagementBackend
├── config.py            # OpenStackConfig (parsed from backend_settings)
├── keystone_client.py   # Low-level Keystone API client
├── openstack_client.py  # BaseClient wrapper for waldur-site-agent
└── utils.py             # Sanitization, validation, logging helpers

test-config.yaml         # Example agent configuration

Links

• waldur-site-agent
• Waldur docs
• OpenStack Keystone