The keystone CLI is deprecated in favor of python-openstackclient.

UPDATE: It turns out that installing the new client can cause issues with Keystone. I found this out the hard way yesterday when it failed during a demo, preventing authentication from the command line. After a few hours troubleshooting it turns out Apache (httpd.service) and Keystone (openstack-keystone.service) were clashing. I was unable to fix this regardless of updating each of these services config files to separate them out. Finally guessed it might be the last package I installed that was the cause. After removing python-openstackclient and rebooting the controller node the issue was fixed.

Original post
In OpenStack Kilo the Depreciation message for the Keystone CLI will be displayed whenever using invoking the keystone command. “

To move to the new python-openstackclient, simply install it. On RHEL7.1:

After that it will be available as the command “openstack”. It can be invoked in interactive mode just by typing “openstack” or directly from the command line to get information. For example, to list users:
Old Keystone CLI: “

New Openstack CLI: “

To be more similar to the output of the old command issue “

” to get the extra fields.

You may also want to update the script “openstack-status” so it uses the new client. To do so, please:
1. Edit

with your favorite editor
2. Replace the old command with the new one (around line 227) like so:

The new CLI can do a lot more of course. For a full list of commands please refer to the below (executed with “openstack” + command):

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.