Quick Access to IBM Cloud Service Credentials from a Python Notebook

See all your orgs, spaces, and services together in one place

As a developer, I’m frequently trying to locate IBM Cloud service instances that I’ve provisioned or that I was given access to over time. I am a member of multiple organizations (three to be specific, currently containing 15+ spaces) and I’m having a hard time remembering in which organization and space the service instance I’d like to access is located.

The IBM Cloud web console and the IBM Cloud Developer Tools CLI both only display service instances for a single Cloud Foundry organization/space combination, such as ptitzler_org/dev as shown below.

IBM Cloud web console and IBM Cloud Developer Tools CLI limit service instance views to a single Cloud Foundry organization and space.

To locate a service instance, I therefore need to iterate through each possible organization/space combination (using the web GUI or by running the appropriate CLI commands) until the service instance of interest is found. Doable, but inefficient.

Most frequently I’m going through this process to retrieve the service credentials so that I can use the service instance (for example, a data service like Cloudant or an analytical service like Watson Machine Learning) from a notebook or a stand-alone app.

Accessing Cloudant service instance credentials using the cloud console.

I’ve finally taken the opportunity to streamline the process by creating a Python notebook application that gathers and visualizes Cloud Foundry catalog information for organizations, spaces and service instances that a given IBMid or IBM Cloud user API key has access to:

IBM Cloud service instance list with filters for service types, service plans and Cloud Foundry organizations and spaces.

To obtain service credentials, I now just have to run the app in a notebook, apply the desired filter(s) to locate the service instance and click a button to insert the selected credentials into a cell:

Sweet. One click inserts service credentials into a Python Notebook cell for later consumption.

If you’d like to give this a try in your local Jupyter environment or in the cloud, download the notebook, add your IBM Cloud user API key or IBMid credentials and run all cells. The app displays in the last cell. No information is permanently stored or shared.

Note that this application currently only collects information about services that are managed by Cloud Foundry, but does not collect information about services that are managed by IAM.

Cloud Foundry-managed and IAM-managed service instances are displayed separately in the IBM Cloud web console.

To learn more about the application, read on.

About the application

The Python 2.7/3.x application comprises of two classes: a Cloud Foundry service information collector and a visualizer, which are invoked by the Browser class:

Invoking the Cloud Foundry service instance browser app.

Configuration

The application requires IBM Cloud credentials — which can be either an IBMid and password or an IBM Cloud user API key — to fetch information about the resources that the provided credentials have access to. If you prefer to not store the credentials in clear text you can easily capture the input interactively, like so:

import getpass
ibm_cloud_user_api_token = getpass.getpass()
...

Data collection

The data Collector gathers the required information from the IBM Cloud catalog using the Cloud Foundry REST API and stores it in a Pandas DataFrame. Multiple calls are made to load lookup information, which enables the app to display names instead of internal identifiers. Note that no sensitive information (a.k.a., the credentials) is gathered during the collection.

If desired, you can access and explore the DataFrame by calling the Browser class’s getPandasDataFrame() method. I tend to use PixieDust to inspect the content of DataFrames , a nifty Python productivity tool our Developer Advocacy team has built, because it provides interactive filtering and visualization.

Filter the collected data, customize the display or even render it graphically by changing the visualization options.

I’ve decided to keep the data collection code separate from the visualization code. It provides two benefits:

• Data collection could be periodically performed on an as-needed basis (e.g., once a week) by invoking the Collector during off-peak hours and the storing the results in cloud storage. The Visualizer then simply sources the collected data from cloud storage instead of querying the IBM Cloud catalog directly.
• Other utilities could operate on the same data set, without having to collect the information again.

Credential lookup app

The Visualizer is implemented using PixieApps, an open-source framework that uses Python, HTML and CSS to build interactive visualizations for Python notebooks. It’s fairly basic but gets the job done: it displays a set of context-sensitive filters and the list of service instances that meet the filter conditions:

Only organizations in which Cloudant Lite plan instances exist are included in the filter.

Only after a user selects a specific service instance (by clicking the View Credentials button) is a request sent to IBM Cloud using the Cloud Foundry API, retrieving the credentials.

A user can then choose to insert credentials into a new cell, which generates a Python dictionary. With the credentials in place, access to to service instance is only a piece of code away:

Simple credentials consumption scenario.

Serious cred(s)

Got some ideas to improve this app or want to build your own spin-off? All you need to get started is in this Github Repository.