---
title: Charmhub | Deploy OpenStack Exporter using Charmhub - The Open Operator Collection
description: Deploy the latest version of OpenStack Exporter on any cloud.
url: https://charmhub.io/openstack-exporter/docs/security
---

# OpenStack Exporter

[Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers")

* [Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers")

Platform:

24.04

22.04

stable 75

```
juju deploy openstack-exporter
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://github.com/canonical/openstack-exporter-operator)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/openstack-exporter-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

## [Security](https://charmhub.io/openstack-exporter/docs/security#p-34262-security)

The charm integrates with Keystone over the keystone-admin interface, which provides admin credentials for the OpenStack deployment. These admin credentials are written to disk on the charm unit at `/var/snap/charmed-openstack-exporter/common/clouds.yaml` (file is owned by root, writable by root only, readable by everyone).

By default, the connection between openstack-exporter and the openstack APIs is not encrypted. To configure encryption, this must be done from the keystone side; see <https://charmhub.io/keystone> (TLS section). The user may need to manually set the ssl\_ca option on this openstack-exporter charm if a custom CA is used.

Openstack-exporter provides a HTTP web service for prometheus to scrape. This service listens on all interfaces at a port configurable by the port charm option (defaults to 9180). The exporter itself has experimental support for TLS encryption and authentication; however, this feature is not yet supported by the charm.

### [Risks](https://charmhub.io/openstack-exporter/docs/security#p-34262-risks)

* [Openstack-exporter](https://github.com/openstack-exporter/openstack-exporter) operates with admin permissions on the cloud. The exporter is not designed to make changes to the cloud, but it technically has permission to do anything.
* The exporter exposes metrics on an unsecured http server about the openstack deployment that may be sensitive. Care should be taken to restrict network access to the machine.

### [Information security](https://charmhub.io/openstack-exporter/docs/security#p-34262-information-security)

Openstack-exporter metrics include metadata of OpenStack resources, such as loadbalancers, vms, and subnets.

---