So far, I have accessed instances by providing their username and a password.
This doesn't work all the time though.
Most cloud images that you can retrieve from the various providers do
not configure passwords, and you have to use cryptographic keys to
authenticate yourself, and that means you have to have your own
private key on the client side, and on the server side, a public key
that matches the private key. So the question is how do you get that
public key onto the server? You could copy it manually, but that is
not so easy to do if you have hundreds or thousands of instances to manage.
Therefore, Nova has a solution. It maintains key pairs in its own
database, and you can now launch an instance and provide a keypair
name, and Nova will then copy that key to the instance.
How that is really done will be covered shortly.
You have already launched instances with a key using the GUI.
In this case, you have imported an existing key into Nova and then
launched the instance with it. You can also create keys by clicking
on the plus sign in the launch instance dialog.
You can also manage keys in the Access and Security dialog,
and also import keys there as well.
On the commandline, you can also import keys, or you can have Nova generate keys.
To generate a key, you use the openstack keypair create command,
and just provide the name. Nova will then create the private and
public key, put the public key into the database, and output the private key.
The best practice is to redirect the output to a file.
Nova will then forget about the private key, and leave it up to you to manage it.
Such a key file has to have correct permissions; otherwise,
SSH will not accept it. So ensure that it is only accessible by the owner.
To import a key, you use this command, you provide the --public-key
option and a file that contains the public key.
In this case, Nova doesn't generate anything, it just takes this
public key and puts it into the database.
If you need to know the public key of a keypair, you can dump it out
like this, and if you want to create a server with a key, you just use
the --key-name option, which you add to all the other options of that command.
Nova provides similar commands shown here at the bottom of the slide.