OS Manuals

/opt/chainguard/openstack-barbican-2026.1/bin/nova

OpenStack Key Manager (Barbican) — 2026.1 Gazpacho

From openstack-barbican-2026.1 22.0.0_git20260928-r12 (enterprise-packages), captured 2026-11-08 by running nova --help (exit 0). permalink

nova CLI is deprecated and will be removed in a future release
usage: nova [--version] [--debug] [--os-cache] [--timings] [--os-region-name <region-name>]
            [--service-type <service-type>] [--service-name <service-name>]
            [--os-endpoint-type <endpoint-type>] [--os-compute-api-version <compute-api-ver>]
            [--os-endpoint-override <bypass-url>] [--profile HMAC_KEY] [--insecure]
            [--os-cacert <ca-certificate>] [--os-cert <certificate>] [--os-key <key>]
            [--timeout <seconds>] [--collect-timing] [--os-auth-type <name>]
            [--os-auth-url OS_AUTH_URL] [--os-system-scope OS_SYSTEM_SCOPE]
            [--os-domain-id OS_DOMAIN_ID] [--os-domain-name OS_DOMAIN_NAME]
            [--os-project-id OS_PROJECT_ID] [--os-project-name OS_PROJECT_NAME]
            [--os-project-domain-id OS_PROJECT_DOMAIN_ID]
            [--os-project-domain-name OS_PROJECT_DOMAIN_NAME] [--os-trust-id OS_TRUST_ID]
            [--os-default-domain-id OS_DEFAULT_DOMAIN_ID]
            [--os-default-domain-name OS_DEFAULT_DOMAIN_NAME] [--os-user-id OS_USER_ID]
            [--os-username OS_USERNAME] [--os-user-domain-id OS_USER_DOMAIN_ID]
            [--os-user-domain-name OS_USER_DOMAIN_NAME] [--os-password OS_PASSWORD]
            <subcommand> ...

Command-line interface to the OpenStack Nova API.

Positional arguments:
  <subcommand>
    add-secgroup                Add a Security Group to a server.
    agent-create                DEPRECATED Create new agent build.
    agent-delete                DEPRECATED Delete existing agent build.
    agent-list                  DEPRECATED List all builds.
    agent-modify                DEPRECATED Modify existing agent build.
    aggregate-add-host          Add the host to the specified aggregate.
    aggregate-cache-images      Request images be cached. (Supported by API versions '2.81' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    aggregate-create            Create a new aggregate with the specified details.
    aggregate-delete            Delete the aggregate.
    aggregate-list              Print a list of all aggregates.
    aggregate-remove-host       Remove the specified host from the specified aggregate.
    aggregate-set-metadata      Update the metadata associated with the aggregate.
    aggregate-show              Show details of the specified aggregate.
    aggregate-update            Update the aggregate's name and optionally availability zone.
    availability-zone-list      List all the availability zones.
    backup                      Backup a server by creating a 'backup' type snapshot.
    boot                        Boot a new server.
    clear-password              Clear the admin password for a server from the metadata server.
                                This action does not actually change the instance server password.
    console-log                 Get console log output of a server.
    delete                      Immediately shut down and delete specified server(s).
    diagnostics                 Retrieve server diagnostics.
    evacuate                    Evacuate server from failed host.
    flavor-access-add           Add flavor access for the given tenant.
    flavor-access-list          Print access information about the given flavor.
    flavor-access-remove        Remove flavor access for the given tenant.
    flavor-create               Create a new flavor.
    flavor-delete               Delete a specific flavor
    flavor-key                  Set or unset extra_spec for a flavor.
    flavor-list                 Print a list of available 'flavors' (sizes of servers).
    flavor-show                 Show details about the given flavor.
    flavor-update               Update the description of an existing flavor. (Supported by API
                                versions '2.55' - '2.latest') [hint: use '--os-compute-api-
                                version' flag to show help message for proper version]
    force-delete                Force delete a server.
    get-mks-console             Get an MKS console to a server. (Supported by API versions '2.8' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    get-password                Get the admin password for a server. This operation calls the
                                metadata service to query metadata information and does not read
                                password information from the server itself.
    get-rdp-console             Get a rdp console to a server.
    get-serial-console          Get a serial console to a server.
    get-spice-console           Get a spice console to a server.
    get-vnc-console             Get a vnc console to a server.
    host-evacuate               Evacuate all instances from failed host.
    host-evacuate-live          Live migrate all instances off the specified host to other
                                available hosts.
    host-meta                   Set or Delete metadata on all instances of a host.
    host-servers-migrate        Cold migrate all instances off the specified host to other
                                available hosts.
    hypervisor-list             List hypervisors. (Supported by API versions '2.0' - '2.latest')
                                [hint: use '--os-compute-api-version' flag to show help message
                                for proper version]
    hypervisor-servers          List servers belonging to specific hypervisors.
    hypervisor-show             Display the details of the specified hypervisor.
    hypervisor-stats            (Supported by API versions '2.0' - '2.latest') [hint: use '--os-
                                compute-api-version' flag to show help message for proper version]
    hypervisor-uptime           Display the uptime of the specified hypervisor.
    image-create                Create a new image by taking a snapshot of a running server.
    instance-action             Show an action.
    instance-action-list        List actions on a server. (Supported by API versions '2.0' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    instance-usage-audit-log    List/Get server usage audits.
    interface-attach            Attach a network interface to a server.
    interface-detach            Detach a network interface from a server.
    interface-list              List interfaces attached to a server.
    keypair-add                 Create a new key pair for use with servers.
    keypair-delete              Delete keypair given by its name. (Supported by API versions '2.0'
                                - '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    keypair-list                Print a list of keypairs for a user (Supported by API versions
                                '2.0' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    keypair-show                Show details about the given keypair. (Supported by API versions
                                '2.0' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    limits                      Print rate and absolute limits.
    list                        List servers.
    list-secgroup               List Security Group(s) of a server.
    live-migration              Migrate running server to a new machine.
    live-migration-abort        Abort an on-going live migration. (Supported by API versions
                                '2.24' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    live-migration-force-complete
                                Force on-going live migration to complete. (Supported by API
                                versions '2.22' - '2.latest') [hint: use '--os-compute-api-
                                version' flag to show help message for proper version]
    lock                        Lock a server. A normal (non-admin) user will not be able to
                                execute actions on a locked server.
    meta                        Set or delete metadata on a server.
    migrate                     Migrate a server.
    migration-list              Print a list of migrations. (Supported by API versions '2.0' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    pause                       Pause a server.
    quota-class-show            List the quotas for a quota class.
    quota-class-update          Update the quotas for a quota class. (Supported by API versions
                                '2.0' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    quota-defaults              List the default quotas for a tenant.
    quota-delete                Delete quota for a tenant/user so their quota will Revert back to
                                default.
    quota-show                  List the quotas for a tenant/user.
    quota-update                Update the quotas for a tenant/user. (Supported by API versions
                                '2.0' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    reboot                      Reboot a server.
    rebuild                     Shutdown, re-image, and re-boot a server.
    refresh-network             Refresh server network information.
    remove-secgroup             Remove a Security Group from a server.
    rescue                      Reboots a server into rescue mode, which starts the machine from
                                either the initial image or a specified image, attaching the
                                current boot disk as secondary.
    reset-network               Reset network of a server.
    reset-state                 Reset the state of a server.
    resize                      Resize a server.
    resize-confirm              Confirm a previous resize.
    resize-revert               Revert a previous resize (and return to the previous VM).
    restore                     Restore a soft-deleted server.
    resume                      Resume a server.
    server-group-create         Create a new server group with the specified details. (Supported
                                by API versions '2.0' - '2.latest') [hint: use '--os-compute-api-
                                version' flag to show help message for proper version]
    server-group-delete         Delete specific server group(s).
    server-group-get            Get a specific server group.
    server-group-list           Print a list of all server groups.
    server-migration-list       Get the migrations list of specified server. (Supported by API
                                versions '2.23' - '2.latest') [hint: use '--os-compute-api-
                                version' flag to show help message for proper version]
    server-migration-show       Get the migration of specified server. (Supported by API versions
                                '2.23' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    server-tag-add              Add one or more tags to a server. (Supported by API versions
                                '2.26' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    server-tag-delete           Delete one or more tags from a server. (Supported by API versions
                                '2.26' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    server-tag-delete-all       Delete all tags from a server. (Supported by API versions '2.26' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    server-tag-list             Get list of tags from a server. (Supported by API versions '2.26'
                                - '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    server-tag-set              Set list of tags to a server. (Supported by API versions '2.26' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    server-topology             Retrieve server topology. (Supported by API versions '2.78' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    service-delete              Delete the service by UUID ID. If deleting a nova-compute service,
                                be sure to stop the actual nova-compute process on the physical
                                host before deleting the service with this command. Failing to do
                                so can lead to the running service re-creating orphaned
                                compute_nodes table records in the database. (Supported by API
                                versions '2.0' - '2.latest') [hint: use '--os-compute-api-version'
                                flag to show help message for proper version]
    service-disable             Disable the service. (Supported by API versions '2.0' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    service-enable              Enable the service. (Supported by API versions '2.0' - '2.latest')
                                [hint: use '--os-compute-api-version' flag to show help message
                                for proper version]
    service-force-down          Force service to down. (Supported by API versions '2.11' -
                                '2.latest') [hint: use '--os-compute-api-version' flag to show
                                help message for proper version]
    service-list                Show a list of all running services. Filter by host & binary.
    set-password                Change the admin password for a server.
    shelve                      Shelve a server.
    shelve-offload              Remove a shelved server from the compute node.
    show                        Show details about the given server.
    ssh                         SSH into a server.
    start                       Start the server(s).
    stop                        Stop the server(s).
    suspend                     Suspend a server.
    trigger-crash-dump          Trigger crash dump in an instance. (Supported by API versions
                                '2.17' - '2.latest') [hint: use '--os-compute-api-version' flag to
                                show help message for proper version]
    unlock                      Unlock a server.
    unpause                     Unpause a server.
    unrescue                    Restart the server from normal boot disk again.
    unshelve                    Unshelve a server.
    update                      Update the name or the description for a server.
    usage                       Show usage data for a single tenant.
    usage-list                  List usage data for all tenants.
    version-list                List all API versions.
    volume-attach               Attach a volume to a server.
    volume-attachments          List all the volumes attached to a server.
    volume-detach               Detach a volume from a server.
    volume-update               Update the attachment on the server. If dest_volume is the same as
                                the src_volume then the command migrates the data from the
                                attached volume to the specified available volume and swaps out
                                the active attachment to the new volume. Otherwise it only updates
                                the parameters of the existing attachment.
    bash-completion             Prints all of the commands and options to stdout so that the
                                nova.bash_completion script doesn't have to hard code them.
    help                        Display help about this program or one of its subcommands.

Options:
  --version                     show program's version number and exit
  --debug                       Print debugging output.
  --os-cache                    Use the auth token cache. Defaults to False if env[OS_CACHE] is
                                not set.
  --timings                     Print call timing info.
  --os-region-name <region-name>
                                Defaults to env[OS_REGION_NAME].
  --service-type <service-type>
                                Defaults to compute for most actions.
  --service-name <service-name>
                                Defaults to env[NOVA_SERVICE_NAME].
  --os-endpoint-type <endpoint-type>
                                Defaults to env[NOVA_ENDPOINT_TYPE], env[OS_ENDPOINT_TYPE] or
                                publicURL.
  --os-compute-api-version <compute-api-ver>
                                Accepts X, X.Y (where X is major and Y is minor part) or
                                "X.latest", defaults to env[OS_COMPUTE_API_VERSION].
  --os-endpoint-override <bypass-url>
                                Use this API endpoint instead of the Service Catalog. Defaults to
                                env[OS_ENDPOINT_OVERRIDE].
  --profile HMAC_KEY            HMAC key to use for encrypting context data for performance
                                profiling of operation. This key should be the value of the HMAC
                                key configured for the OSprofiler middleware in nova; it is
                                specified in the Nova configuration file at "/etc/nova/nova.conf".
                                Without the key, profiling will not be triggered even if
                                OSprofiler is enabled on the server side.
  --os-auth-type, --os-auth-plugin <name>
                                Authentication type to use

API Connection Options:
  Options controlling the HTTP API Connections

  --insecure                    Explicitly allow client to perform "insecure" TLS (https)
                                requests. The server's certificate will not be verified against
                                any certificate authorities. This option should be used with
                                caution.
  --os-cacert <ca-certificate>  Specify a CA bundle file to use in verifying a TLS (https) server
                                certificate. Defaults to env[OS_CACERT].
  --os-cert <certificate>       The location for the keystore (PEM formatted) containing the
                                public key of this client. Defaults to env[OS_CERT].
  --os-key <key>                The location for the keystore (PEM formatted) containing the
                                private key of this client. Defaults to env[OS_KEY].
  --timeout <seconds>           Set request timeout (in seconds).
  --collect-timing              Collect per-API call timing information.

Authentication Options:
  Options specific to the password plugin.

  --os-auth-url OS_AUTH_URL     Authentication URL
  --os-system-scope OS_SYSTEM_SCOPE
                                Scope for system operations
  --os-domain-id OS_DOMAIN_ID   Domain ID to scope to
  --os-domain-name OS_DOMAIN_NAME
                                Domain name to scope to
  --os-project-id, --os-tenant-id OS_PROJECT_ID
                                Project ID to scope to
  --os-project-name, --os-tenant-name OS_PROJECT_NAME
                                Project name to scope to
  --os-project-domain-id OS_PROJECT_DOMAIN_ID
                                Domain ID containing project
  --os-project-domain-name OS_PROJECT_DOMAIN_NAME
                                Domain name containing project
  --os-trust-id OS_TRUST_ID     ID of the trust to use as a trustee use
  --os-default-domain-id OS_DEFAULT_DOMAIN_ID
                                Optional domain ID to use with v3 and v2 parameters. It will be
                                used for both the user and project domain in v3 and ignored in v2
                                authentication.
  --os-default-domain-name OS_DEFAULT_DOMAIN_NAME
                                Optional domain name to use with v3 API and v2 parameters. It will
                                be used for both the user and project domain in v3 and ignored in
                                v2 authentication.
  --os-user-id OS_USER_ID       User id
  --os-username, --os-user-name OS_USERNAME
                                Username
  --os-user-domain-id OS_USER_DOMAIN_ID
                                User's domain id
  --os-user-domain-name OS_USER_DOMAIN_NAME
                                User's domain name
  --os-password OS_PASSWORD     User's password

See "nova help COMMAND" for help on a specific command.
Options (34)
OptionDescriptionSource
--versionshow program's version number and exithelp
--debugPrint debugging output.help
--os-cacheUse the auth token cache.help
--timingsPrint call timing info.help
--os-region-name region-nameDefaults to env[OS_REGION_NAME].help
--service-type service-typeDefaults to compute for most actions.help
--service-name service-nameDefaults to env[NOVA_SERVICE_NAME].help
--os-endpoint-type endpoint-typeDefaults to env[NOVA_ENDPOINT_TYPE], env[OS_ENDPOINT_TYPE] or publicURL.help
--os-compute-api-version compute-api-verAccepts X, X.Y (where X is major and Y is minor part) or "X.latest", defaults to env[OS_COMPUTE_API_VERSION].help
--os-endpoint-override bypass-urlUse this API endpoint instead of the Service Catalog.help
--profile HMAC_KEYHMAC key to use for encrypting context data for performance profiling of operation.help
--os-auth-type, --os-auth-plugin nameAuthentication type to usehelp
--insecureExplicitly allow client to perform "insecure" TLS (https) requests.help
--os-cacert ca-certificateSpecify a CA bundle file to use in verifying a TLS (https) server certificate.help
--os-cert certificateThe location for the keystore (PEM formatted) containing the public key of this client.help
--os-key keyThe location for the keystore (PEM formatted) containing the private key of this client.help
--timeout secondsSet request timeout (in seconds).help
--collect-timingCollect per-API call timing information.help
--os-auth-url OS_AUTH_URLAuthentication URLhelp
--os-system-scope OS_SYSTEM_SCOPEScope for system operationshelp
--os-domain-id OS_DOMAIN_IDDomain ID to scope tohelp
--os-domain-name OS_DOMAIN_NAMEDomain name to scope tohelp
--os-project-id, --os-tenant-id OS_PROJECT_IDProject ID to scope tohelp
--os-project-name, --os-tenant-name OS_PROJECT_NAMEProject name to scope tohelp
--os-project-domain-id OS_PROJECT_DOMAIN_IDDomain ID containing projecthelp
--os-project-domain-name OS_PROJECT_DOMAIN_NAMEDomain name containing projecthelp
--os-trust-id OS_TRUST_IDID of the trust to use as a trustee usehelp
--os-default-domain-id OS_DEFAULT_DOMAIN_IDOptional domain ID to use with v3 and v2 parameters.help
--os-default-domain-name OS_DEFAULT_DOMAIN_NAMEOptional domain name to use with v3 API and v2 parameters.help
--os-user-id OS_USER_IDUser idhelp
--os-username, --os-user-name OS_USERNAMEUsernamehelp
--os-user-domain-id OS_USER_DOMAIN_IDUser's domain idhelp
--os-user-domain-name OS_USER_DOMAIN_NAMEUser's domain namehelp
--os-password OS_PASSWORDUser's passwordhelp

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.