The Connection class is the primary interface to the Python SDK it maintains a context for a connection to a cloud provider. The connection has an attribute to access each supported service. The service attributes are created dynamically based on user profiles and the service catalog.


At a minimum, the Connection class needs to be created with an authenticator or the parameters to build one.

Create a connection

The following example constructor uses the identity authenticator using username and password. The default settings for the transport are used by this connection.:

from openstack import connection
auth_args = {
    'auth_url': '',
    'project_name': 'admin',
    'username': 'admin',
    'password': 'admin',
conn = connection.Connection(**auth_args)


Services are accessed through an attribute named after the service. A list of all the projects is retrieved in this manner:

projects = conn.identity.list_projects()

Find or create

If you wanted to make sure you had a network named ‘jenkins’, you would first try to find it and if that fails, you would create it:

network ="jenkins")
if network is None:
    network ={"name": "jenkins"})


openstack.connection.from_config(cloud_name=None, cloud_config=None, options=None)

Create a Connection using os-client-config

  • cloud_name (str) – Use the cloud_name configuration details when creating the Connection instance.
  • cloud_config – An instance of os_client_config.config.OpenStackConfig as returned from the os-client-config library. If no config is provided, os_client_config.OpenStackConfig will be called, and the provided cloud_name will be used in determining which cloud’s configuration details will be used in creation of the Connection instance.
  • options – An argparse Namespace object; allows direct passing in of argparse options to be added to the cloud config. This value is passed to the argparse argument of os_client_config.config.OpenStackConfig.get_one_cloud.
Return type:


Connection Object

class openstack.connection.Connection(session=None, authenticator=None, profile=None, verify=True, cert=None, user_agent=None, auth_plugin='password', **auth_args)

Create a context for a connection to a cloud provider.

A connection needs a transport and an authenticator. The user may pass in a transport and authenticator they want to use or they may pass in the parameters to create a transport and authenticator. The connection creates a Session which uses the profile and authenticator to perform HTTP requests.

  • session (Session) – A session object compatible with Session.
  • authenticator (BaseAuthPlugin) – An authenticator derived from the base authenticator plugin that was previously created. Two common authentication identity plugins are identity_v2 and identity_v3. If this parameter is not passed in, the connection will create an authenticator.
  • profile (Profile) – If the user has any special profiles such as the service name, region, version or interface, they may be provided in the profile object. If no profiles are provided, the services that appear first in the service catalog will be used.
  • verify (bool) – If a transport is not provided to the connection, this parameter will be used to create a transport. If verify is set to true, which is the default, the SSL cert will be verified. It can also be set to a CA_BUNDLE path.
  • cert (str or tuple) – If a transport is not provided to the connection then this parameter will be used to create a transport. cert allows to provide a client certificate file path or a tuple with client certificate and key paths.
  • user_agent (str) – If a transport is not provided to the connection, this parameter will be used when creating a transport. The value given here will be prepended to the default, which is specified in USER_AGENT. The resulting user_agent value is used for the User-Agent HTTP header.
  • auth_plugin (str) – The name of authentication plugin to use. The default value is password.
  • auth_args – The rest of the parameters provided are assumed to be authentication arguments that are used by the authentication plugin.

Authorize this Connection

NOTE: This method is optional. When an application makes a call
to any OpenStack service, this method allows you to request a token manually before attempting to do anything else.
Returns:A string token.
:raises:`~openstack.exceptions.HttpException` if the authorization
fails due to reasons like the credentials provided are unable to be authorized or the auth_plugin argument is missing, etc.