Menu
Grafana Cloud

discovery.openstack

discovery.openstack discovers OpenStack Nova instances and exposes them as targets.

Usage

alloy
discovery.openstack "LABEL" {
  role   = "hypervisor"
  region = "us-east-1"
}

Arguments

The following arguments are supported:

NameTypeDescriptionDefaultRequired
rolestringRole of the discovered targets.yes
regionstringOpenStack region.yes
identity_endpointstringSpecifies the HTTP endpoint that is required to work with te Identity API of the appropriate versionno
usernamestringOpenStack username for the Identity V2 and V3 APIs.no
useridstringOpenStack userid for the Identity V2 and V3 APIs.no
passwordsecretPassword for the Identity V2 and V3 APIs.no
domain_namestringOpenStack domain name for the Identity V2 and V3 APIs.no
domain_idstringOpenStack domain ID for the Identity V2 and V3 APIs.no
project_namestringOpenStack project name for the Identity V2 and V3 APIs.no
project_idstringOpenStack project ID for the Identity V2 and V3 APIs.no
application_credential_namestringOpenStack application credential name for the Identity V2 and V3 APIs.no
application_credential_idstringOpenStack application credential ID for the Identity V2 and V3 APIs.no
application_credential_secretsecretOpenStack application credential secret for the Identity V2 and V3 APIs.no
all_tenantsboolWhether the service discovery should list all instances for all projects.falseno
refresh_intervaldurationRefresh interval to re-read the instance list.60sno
portintThe port to scrape metrics from.80no
availabilitystringThe availability of the endpoint to connect to.publicno

role must be one of hypervisor or instance.

username is required if using Identity V2 API. In Identity V3, either userid or a combination of username and domain_id or domain_name are needed.

project_id and project_name fields are optional for the Identity V2 API. Some providers allow you to specify a project_name instead of the project_id. Some require both.

application_credential_id or application_credential_name fields are required if using an application credential to authenticate. Some providers allow you to create an application credential to authenticate rather than a password.

application_credential_secret field is required if using an application credential to authenticate.

all_tenants is only relevant for the instance role and usually requires admin permissions.

availability must be one of public, admin, or internal.

Blocks

The following blocks are supported inside the definition of discovery.openstack:

HierarchyBlockDescriptionRequired
tls_configtls_configTLS configuration for requests to the OpenStack API.no

tls_config block

NameTypeDescriptionDefaultRequired
ca_pemstringCA PEM-encoded text to validate the server with.no
ca_filestringCA certificate to validate the server with.no
cert_pemstringCertificate PEM-encoded text for client authentication.no
cert_filestringCertificate file for client authentication.no
insecure_skip_verifyboolDisables validation of the server certificate.no
key_filestringKey file for client authentication.no
key_pemsecretKey PEM-encoded text for client authentication.no
min_versionstringMinimum acceptable TLS version.no
server_namestringServerName extension to indicate the name of the server.no

The following pairs of arguments are mutually exclusive and can’t both be set simultaneously:

  • ca_pem and ca_file
  • cert_pem and cert_file
  • key_pem and key_file

When configuring client authentication, both the client certificate (using cert_pem or cert_file) and the client key (using key_pem or key_file) must be provided.

When min_version is not provided, the minimum acceptable TLS version is inherited from Go’s default minimum version, TLS 1.2. If min_version is provided, it must be set to one of the following strings:

  • "TLS10" (TLS 1.0)
  • "TLS11" (TLS 1.1)
  • "TLS12" (TLS 1.2)
  • "TLS13" (TLS 1.3)

Exported fields

The following fields are exported and can be referenced by other components:

NameTypeDescription
targetslist(map(string))The set of targets discovered from the OpenStack API.

hypervisor

The hypervisor role discovers one target per Nova hypervisor node. The target address defaults to the host_ip attribute of the hypervisor.

  • __meta_openstack_hypervisor_host_ip: the hypervisor node’s IP address.
  • __meta_openstack_hypervisor_hostname: the hypervisor node’s name.
  • __meta_openstack_hypervisor_id: the hypervisor node’s ID.
  • __meta_openstack_hypervisor_state: the hypervisor node’s state.
  • __meta_openstack_hypervisor_status: the hypervisor node’s status.
  • __meta_openstack_hypervisor_type: the hypervisor node’s type.

instance

The instance role discovers one target per network interface of Nova instance. The target address defaults to the private IP address of the network interface.

  • __meta_openstack_address_pool: the pool of the private IP.
  • __meta_openstack_instance_flavor: the flavor of the OpenStack instance.
  • __meta_openstack_instance_id: the OpenStack instance ID.
  • __meta_openstack_instance_image: the ID of the image the OpenStack instance is using.
  • __meta_openstack_instance_name: the OpenStack instance name.
  • __meta_openstack_instance_status: the status of the OpenStack instance.
  • __meta_openstack_private_ip: the private IP of the OpenStack instance.
  • __meta_openstack_project_id: the project (tenant) owning this instance.
  • __meta_openstack_public_ip: the public IP of the OpenStack instance.
  • __meta_openstack_tag_<tagkey>: each tag value of the instance.
  • __meta_openstack_user_id: the user account owning the tenant.

Component health

discovery.openstack is only reported as unhealthy when given an invalid configuration. In those cases, exported fields retain their last healthy values.

Debug information

discovery.openstack does not expose any component-specific debug information.

Debug metrics

discovery.openstack does not expose any component-specific debug metrics.

Example

alloy
discovery.openstack "example" {
  role   = OPENSTACK_ROLE
  region = OPENSTACK_REGION
}

prometheus.scrape "demo" {
  targets    = discovery.openstack.example.targets
  forward_to = [prometheus.remote_write.demo.receiver]
}

prometheus.remote_write "demo" {
  endpoint {
    url = PROMETHEUS_REMOTE_WRITE_URL

    basic_auth {
      username = USERNAME
      password = PASSWORD
    }
  }
}

Replace the following:

  • OPENSTACK_ROLE: Your OpenStack role.
  • OPENSTACK_REGION: Your OpenStack region.
  • PROMETHEUS_REMOTE_WRITE_URL: The URL of the Prometheus remote_write-compatible server to send metrics to.
  • USERNAME: The username to use for authentication to the remote_write API.
  • PASSWORD: The password to use for authentication to the remote_write API.

Compatible components

discovery.openstack has exports that can be consumed by the following components:

Note

Connecting some components may not be sensible or components may require further configuration to make the connection work correctly. Refer to the linked documentation for more details.