How to get credentials used for accessing EODATA on a cloud VM on CODE-DE-Lab

To configure an S3 client for EODATA, you need an access key and a secret key. On a VM with EODATA access already configured, you can retrieve the existing pair from a Linux credentials file, OpenStack metadata or a Windows Rclone configuration.

The methods below cover Linux VMs created from default or custom images and Windows VMs. If the VM has no usable credentials, create a personal pair in Tenant Manager as described below.

Prerequisites

No. 1 Account

You need a CODE-DE-Lab account with access to Horizon: https://identity.cloudferro.com/auth/realms/CODE-DE3/account/. To create personal credentials, you also need access to Tenant Manager.

No. 2 Access to the virtual machine

Run the commands inside the VM whose EODATA credentials you want to retrieve. On Linux, you need sudo to read the credentials file and curl for the metadata method. On Windows, use PowerShell and an account that can read the existing Rclone configuration.

For VM setup and access, see:

No. 3 Network access

The metadata methods require access from the VM to 169.254.169.254. To use the retrieved credentials with an S3 client, the VM must resolve eodata.code-de.org and reach it over HTTPS on port 443.

Retrieve credentials on Linux

Read the existing credentials file

The CODE-DE-Lab post-migration mount configuration uses /etc/passwd-s3fs. If EODATA was configured with that procedure, read the file:

sudo cat /etc/passwd-s3fs

The file contains the access key followed by a colon and the secret key. For example, an access key of 1234 and a secret key of 4321 appear as:

1234:4321

These are example values. Use the actual keys from your VM. If the file is missing or contains outdated credentials, try the metadata method or create personal credentials in Tenant Manager.

Read OpenStack metadata

This method can be used on default or custom Linux images when the VM metadata contains EODATA credentials. Run:

curl http://169.254.169.254/openstack/latest/vendor_data2.json

Important

The metadata address 169.254.169.254 is fixed. Do not replace it with the VM’s IP address or the EODATA endpoint.

Find the EODATA entry in nova.vmconfig.mountpoints. The relevant part of the response has the following structure; 1234 and 4321 are example keys:

{
  "nova": {
    "vmconfig": {
      "mountpoints": [
        {
          "s3_access_key": "1234",
          "s3_secret_key": "4321",
          "s3_url": "eodata.code-de.org",
          "s3_bucket": "eodata",
          "repomount": "/eodata"
        }
      ]
    }
  }
}

Use s3_access_key as the access key and s3_secret_key as the secret key. If these fields are absent, empty or contain placeholders, use Tenant Manager. If a retrieved pair no longer works, create a personal pair there.

Retrieve credentials on Windows

Read an existing Rclone configuration

If Rclone already provides EODATA access on the VM, open its configuration file. A preconfigured image may use:

C:\Users\Administrator\.config\rclone\rclone.conf

To find the configuration used by your Rclone installation, run rclone config file under the Windows account that runs Rclone. If the mount command specifies a separate file with –config, inspect that file.

Find the S3 section for eodata.code-de.org. An example is:

[DIAS]
type = s3
provider = Other
access_key_id = 1234
secret_access_key = 4321
endpoint = https://eodata.code-de.org
region = s3.fra1-3.cloudferro.com

Read the actual values of access_key_id and secret_access_key. The section name may differ. If no EODATA configuration exists, use the metadata method or create personal credentials in Tenant Manager.

Read OpenStack metadata with PowerShell

Run this command inside the Windows VM:

Invoke-WebRequest -URI http://169.254.169.254/openstack/latest/vendor_data2.json -UseBasicParsing

In the Content field, find s3_access_key and s3_secret_key in the EODATA mountpoint. The JSON structure and checks are the same as in the Linux metadata method above.

Create personal credentials in Tenant Manager

Use this method when the VM has no usable credentials or when configuring access from your own computer.

Sign in to Tenant Manager.
Open Configuration > EODATA Access.
Select Add credentials and choose an expiry date.
Save the Access Key and Secret Key in a password manager. The secret key is displayed only once.

Configure the S3 client

Use these settings with your key pair:

Setting	Value
Endpoint	https://eodata.code-de.org
Region for request signing	s3.fra1-3.cloudferro.com
Bucket	eodata

Note

These credentials grant access to EODATA. Private Object Storage uses separate EC2 credentials and the endpoint s3.fra1-3.cloudferro.com.

Next steps

Configure access with one of these methods:

For platform details and repairing an existing mount, see the CODE-DE-Lab post-migration guide.

Still need help?

If this article does not answer all of your questions, the support team will help you.

Contact support