> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/automation-and-cli/terraform-provider.md).

# Terraform Provider

The <code class="expression">space.vars.product\_name</code> (<code class="expression">space.vars.product\_acronym</code>) Terraform provider (`platform9/pcd`) is the first-party way to manage <code class="expression">space.vars.product\_acronym</code> as code. It is published on the public [Terraform Registry](https://registry.terraform.io/providers/platform9/pcd/latest) and works with any standard Terraform (or OpenTofu) workflow.

{% hint style="warning" %}
**Information**

The <code class="expression">space.vars.product\_acronym</code> Terraform provider is currently in `beta`. It is published at a `0.x` version, so resources and attributes can change between releases. Pin a provider version in your configuration and review the release notes before you upgrade.
{% endhint %}

## Overview

The provider manages the OpenStack-compatible services that <code class="expression">space.vars.product\_acronym</code> exposes: Identity Service, Compute Service, Networking Service (including QoS and quotas), Persistent Storage Service, Image Library Service, Load Balancing (Octavia/OVN), DNS (Designate), and Key Management (Barbican). It also manages resources that no community OpenStack provider can reach: <code class="expression">space.vars.product\_acronym</code>'s own cluster blueprints and host configuration and roles, declared as code.

In this guide, you'll install the provider, authenticate against your <code class="expression">space.vars.product\_acronym</code> environment, and create your first resources with Terraform.

## Requirements

| Component                                                   | Version                                                                                 |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| <code class="expression">space.vars.product\_acronym</code> | <code class="expression">space.vars.product\_acronym</code> 2026 April release or later |
| Terraform                                                   | 1.0 or later (provider protocol 6)                                                      |
| OpenTofu                                                    | Any release supporting protocol 6                                                       |

## Install the Provider

Declare the provider in your Terraform configuration and pin a compatible version:

```hcl
terraform {
  required_providers {
    pcd = {
      source  = "platform9/pcd"
      version = "~> 0.1"
    }
  }
}
```

Run `terraform init`. Terraform downloads the provider from the registry and verifies its GPG signature automatically.

## Authenticate

Provider argument names and `OS_*` environment fallbacks mirror `terraform-provider-openstack`. Password, token, and application-credential authentication are all supported, as is sourcing credentials from a `clouds.yaml` file (`cloud` / `OS_CLOUD`).

```hcl
provider "pcd" {
  auth_url    = "https://pcd.example.com/keystone/v3"
  region      = "Infra"
  user_name   = "admin@example.localnet"
  password    = var.pcd_password
  tenant_name = "service"

  user_domain_id    = "default"
  project_domain_id = "default"

  # PCD Community Edition ships a self-signed certificate.
  insecure = true
}
```

Every argument can instead be supplied through the standard OpenStack environment variables (`OS_AUTH_URL`, `OS_USERNAME`, `OS_PASSWORD`, `OS_PROJECT_NAME`, `OS_REGION_NAME`, `OS_INSECURE`, and so on), so existing OpenStack RC files work unchanged.

{% hint style="info" %}
**Self-signed TLS**

Against a Community Edition or lab endpoint, set `insecure = true` (or `OS_INSECURE=true`). For production, prefer pinning the CA with `cacert_file` instead of disabling verification.
{% endhint %}

## Quickstart

This minimal example authenticates, then creates a private network and subnet:

```hcl
terraform {
  required_providers {
    pcd = {
      source  = "platform9/pcd"
      version = "~> 0.1"
    }
  }
}

provider "pcd" {
  # Reads OS_AUTH_URL / OS_USERNAME / OS_PASSWORD / OS_REGION_NAME from the environment.
  insecure = true
}

resource "pcd_networking_network" "app" {
  name           = "app-net"
  admin_state_up = true
}

resource "pcd_networking_subnet" "app" {
  name       = "app-subnet"
  network_id = pcd_networking_network.app.id
  cidr       = "192.168.100.0/24"
  ip_version = 4
}

output "network_id" {
  value = pcd_networking_network.app.id
}
```

```bash
terraform init      # downloads platform9/pcd and verifies its signature
terraform plan
terraform apply
```

Runnable, self-contained examples for every resource and data source, including `import.sh` files for importable resources, are in the provider repository under [`examples/`](https://github.com/platform9/terraform-provider-pcd/tree/main/examples).

## Manage PCD-Native Infrastructure

These resources have no OpenStack-provider equivalent. The most common workflow uses `terraform import`, because <code class="expression">space.vars.product\_acronym</code> keeps one cluster blueprint per region:

```hcl
# Manage the region's existing cluster blueprint in place.
resource "pcd_cluster_blueprint" "region" {
  # Attributes are read back on import; adjust and apply to change them.
}
```

```bash
terraform import pcd_cluster_blueprint.region <blueprint-id>
terraform plan   # reconcile until the plan is empty, then manage changes as code
```

| Resource                     | Manages                                                                                                                                                                                  |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `pcd_cluster_blueprint`      | The region's cluster blueprint: networking type (OVN/OVS), virtual-network segmentation, image library and VM storage, Persistent Storage Service backends, VM HA, and auto-rebalancing. |
| `pcd_host_config`            | A host's mapping of each traffic type (management, VM console, tunnelling, image library, live migration) to a network interface, plus physical-network labels.                          |
| `pcd_host_role`              | Assigns a <code class="expression">space.vars.product\_acronym</code> role (for example, `pf9-ostackhost-neutron`) to an onboarded host.                                                 |
| `pcd_host_config_assignment` | Attaches a host configuration to a host.                                                                                                                                                 |

A read-only `pcd_cluster_blueprint` data source is also available.

## Migrate from terraform-provider-openstack

### PCD Terraform Provider vs. community terraform-provider-openstack

<code class="expression">space.vars.product\_acronym</code> is OpenStack-compatible, so the community [`terraform-provider-openstack`](https://github.com/terraform-provider-openstack/terraform-provider-openstack) can drive most of its OpenStack-compatible surface. The <code class="expression">space.vars.product\_acronym</code> provider is purpose-built and adds what the generic provider cannot:

* **PCD-native resources.** `pcd_cluster_blueprint`, `pcd_host_config`, `pcd_host_role`, and `pcd_host_config_assignment` manage <code class="expression">space.vars.product\_acronym</code>'s own control plane: a region's cluster blueprint and host onboarding, declared as code. There is no `openstack_*` equivalent; this is net-new capability.
* **Built and validated for** <code class="expression">space.vars.product\_acronym</code>**.** Verified against latest <code class="expression">space.vars.product\_acronym</code> releases with first-class handling for <code class="expression">space.vars.product\_acronym</code> specifics such as self-signed TLS and the OVN-only (Layer 4) Octavia provider.
* **A drop-in migration path.** Attribute names, import IDs, and `OS_*` environment variables mirror `terraform-provider-openstack`, so moving an existing configuration is a mechanical rename. See [Migrate from terraform-provider-openstack](#migrate-from-terraform-provider-openstack).

### Migration

Migration is mostly mechanical. Two changes apply to every resource type name:

1. Replace the `openstack_` prefix with `pcd_`.
2. Drop the trailing API-version suffix (`_v2` / `_v3`).

For example, `openstack_networking_network_v2` becomes `pcd_networking_network`. The provider block's authentication arguments are identical; only the provider name changes.

Because the resource type names differ, existing OpenStack-provider state can't be reused directly. The clean path is to `terraform import` each live object into the renamed `pcd_*` resources and reconcile until the plan is empty.

The full mapping table, behavioral differences (for example, the OVN/Layer-4 load-balancer constraints), and import-ID formats are in the Registry guide: [Migrating from terraform-provider-openstack](https://registry.terraform.io/providers/platform9/pcd/latest/docs/guides/migrating-from-openstack).

## Full Resource Reference

Per-resource and per-data-source documentation, including every argument, attribute, and import ID, is generated from the provider schema and published on the Terraform Registry:

[**registry.terraform.io/providers/platform9/pcd/latest/docs**](https://registry.terraform.io/providers/platform9/pcd/latest/docs)

The Registry is the source of truth for the reference; this page covers concepts and getting started.

## Support and Source

* **Source and issues:** [github.com/platform9/terraform-provider-pcd](https://github.com/platform9/terraform-provider-pcd)
* **Examples:** [`examples/` in the repository](https://github.com/platform9/terraform-provider-pcd/tree/main/examples)
* **License:** Mozilla Public License 2.0. Portions are ported from `terraform-provider-openstack` (MPL-2.0) and carry provenance comments.

## Related Pages

* [PCD CLI - pcdctl](/private-cloud-director/automation-and-cli/pcdctl-command-line.md): the pcdctl equivalent for imperative, scripted operations.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.platform9.com/private-cloud-director/automation-and-cli/terraform-provider.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.