Configure the Compute API

The OpenStack Compute API enables users to specify an administrative password when they create or rebuild a server instance. If the user does not specify a password, a random password is generated and returned in the API response.

In practice, how the admin password is handled depends on the hypervisor in use and might require additional configuration of the instance. For example, you might have to install an agent to handle the password setting. If the hypervisor and instance configuration do not support setting a password at server create time, the password that is returned by the create API call is misleading because it was ignored.

To prevent this confusion, use the enable_instance_password configuration option to disable the return of the admin password for installations that do not support setting instance passwords.

OpenStack Compute supports API rate limiting for the OpenStack API. The rate limiting allows an administrator to configure limits on the type and number of API calls that can be made in a specific time interval.

When API rate limits are exceeded, HTTP requests return an error with a status code of 413 Request entity too large, and includes an HTTP Retry-After header. The response body includes the error details and the delay before you should retry the request.

Rate limiting is not available for the EC2 API.

To define limits, set these values:

Rate limits are applied in relative order to the HTTP method, going from least to most specific. For example, although the default threshold for POST to */servers is 50 each day, you cannot POST to */servers more than 10 times in a single minute because the rate limits for any POST is 10 each minute.

Normally, you install OpenStack Compute with the following limits enabled:

As part of the WSGI pipeline, the etc/nova/api-paste.ini file defines the actual limits.

To enable limits, include the ratelimit' filter in the API pipeline specification. If the ratelimit filter is removed from the pipeline, limiting is disabled. You must also define the rate limit filter. The lines appear as follows:

[pipeline:openstack_compute_api_v2]
pipeline = faultwrap authtoken keystonecontext ratelimit osapi_compute_app_v2

[pipeline:openstack_volume_api_v1]
pipeline = faultwrap authtoken keystonecontext ratelimit osapi_volume_app_v1

[filter:ratelimit]
paste.filter_factory = nova.api.openstack.compute.limits:RateLimitingMiddleware.factory

To modify the limits, add a limits specification to the [filter:ratelimit] section of the file. Specify the limits in this order:

The following example shows the default rate-limiting values:

[filter:ratelimit]
paste.filter_factory = nova.api.openstack.compute.limits:RateLimitingMiddleware.factory
limits =(POST, "*", .*, 10, MINUTE);(POST, "*/servers", ^/servers, 50, DAY);(PUT, "*", .*, 10, MINUTE);(GET, "*changes-since*", .*changes-since.*, 3, MINUTE);(DELETE, "*", .*, 100, MINUTE)

The following table lists the Compute API configuration options: