OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent

Get started

The sovereign French Cloud solution of the inherent group, with a European reach

An open source Cloud built on Kubernetes, OVN and KubeVirt

OpenKeel builds a natively multi-tenant Cloud from Cloud Native, open source technologies and is itself open source under the Apache 2.0 license, designed to be SecNumCloud-ready. Its REST APIs are fully compatible with OpenStack's: the same modules, rewritten in Go, deploy on Kubernetes clusters, and a command line makes deployment and life-cycle management plug and play. OpenKeel is a Cloud designed in the AI era and for AI.

  • Sovereign
  • Made in France
  • Apache 2.0
  • SecNumCloud-ready
  • Kubernetes
  • OVN
  • KubeVirt
  • Go
  • OpenStack API
  • Multi-tenant
Get started with okadmDiscover the project
Accelerated replay of a real okadm lab install: kind cluster, operators, data services, the OpenKeel components, then the access URLs

“A modern, sovereign Cloud and Cloud Native platform with a broad ecosystem”

A sovereign French solution with a European reach

OpenKeel is a solution of the inherent group, a French IT group expert in AI, cloud, cybersecurity and connectivity for businesses and public bodies (inherent.fr).

Built on open source software and open standards, OpenKeel gives organisations a Cloud they control: the code, the deployment and the data stay in their hands, on the infrastructure of their choice in France and in Europe.

  • A French solution from the inherent group
  • Open source building blocks, no proprietary lock-in
  • Open source under the Apache License 2.0
  • Deployed on the customer's own Kubernetes clusters
  • Compatible with the OpenStack ecosystem
Visit inherent.fr

OpenKeel at a glance

OpenKeel keeps the contracts that give the OpenStack ecosystem its value (REST API, MariaDB data model, RabbitMQ messages) and replaces their Python implementation with Kubernetes-native Go services.

The data plane is not rewritten: it is handed to proven Cloud Native projects. Kubernetes orchestrates, KubeVirt runs the VMs, OVN carries the tenant networks, CSI provides the volumes.

  • 38 reverse-specs of the upstream repositories
  • 25 Go modules in the workspace
  • Release 2026.2.0, compatible with the OpenStack 2026.2 API
  • Clients, SDKs, Terraform and Tempest unchanged
Vision and principles

Built on Cloud Native, open source technologies

OpenKeel rewrites the control plane and hands the data plane to proven Kubernetes building blocks.

Orchestration

Kubernetes

Each service is a Deployment or a DaemonSet; Kubernetes manages replicas, restarts, configuration and secrets.

Learn more
Networking

OVN and Open vSwitch

Neutron writes networks, routers, ACLs and NAT to OVN Northbound; the VM network stays isolated from the Pod network.

Learn more
Compute

KubeVirt

Nova instances are VirtualMachines; CDI imports the Glance images into volumes.

Learn more
Storage

Any block CSI

Cinder volumes run on Rook-Ceph, Longhorn, NetApp, Huawei Dorado or our own Pure Storage driver; Manila shares go through NFS-Ganesha, S3 and Swift through Ceph RGW.

Learn more
Containers

Kata

Zun runs each container in its own microVM: one kernel per container, its Neutron port as its only network.

Learn more
Resilience

Medik8s and ExternalDNS

Masakari relies on Node Healthcheck and Self Node Remediation; Designate publishes through ExternalDNS.

Learn more

Natively multi-tenant

The Keystone model (domains, projects, roles, policies) splits the Cloud into tenants. Tenants have no access to Kubernetes: only the OpenKeel services create Pods, VMs and volumes.

Each VM NIC is plugged into its own Neutron port in OVN, with no interface on the Pod network; a CNI guard closes the paths to the node. Manila creates an NFS gateway inside the tenant network, and Zun isolates each container in a microVM.

  • Projects, quotas and policies identical to OpenStack
  • Tenant networks isolated from the Kubernetes network
  • port_security against MAC and IP spoofing
  • One Kata microVM per Zun container
Tenant isolation

Designed to be SecNumCloud-ready

SecNumCloud, the ANSSI qualification, applies to a service and its provider, not to a piece of software. OpenKeel is designed so that a provider can qualify a Cloud built on it: it puts no obstacle in the way of a technical requirement, and it supplies the mechanisms and the evidence the audit asks for.

Every requirement is tracked in the open: what is compliant today, what is in progress and what is left to evolve, each with its evidence in the code.

  • Open source Go code, no telemetry, no outbound call
  • A CADF audit event for every API call
  • OpenStack RBAC, MFA in Keystone, Barbican with an HSM
  • Every internal flow in TLS
SecNumCloud: compliant and to evolve

100% compatible with the OpenStack APIs

An OpenKeel component replaces the original without clients, SDKs, Terraform, Tempest or neighbouring services noticing.

Same REST API

  • Paths, parameters, HTTP status codes
  • Error bodies and microversions
  • Identical policies

Same database

  • Same tables and columns
  • Same schema migrations
  • Existing data reusable

Same RabbitMQ messages

  • oslo.messaging envelopes
  • Same RPCs and topics
  • Versioned notifications

The modules rewritten in Go

The OpenStack services, specified from their upstream code then generated in Go, each with its reverse-spec, its diagram and its tests.

Placement

Resource inventories and allocations; the first component rewritten in Go.

GoMariaDB Galera

Nova

Instances run as KubeVirt VirtualMachines; conductor with the scheduler in process, one agent per node.

GoKubeVirt and CDI

Zun

Containers as a Service: one Pod per container, isolated in its own Kata microVM, with its Neutron port as its only network.

GoKata Pods

Masakari

Instance high availability; node health from Node Healthcheck and Self Node Remediation.

GoMedik8s

Ironic

Bare metal: stays upstream Python, packaged in an OpenKeel chart; too many hardware configurations to test.

Chart (upstream Python)Helm chart (upstream Python)

Cinder

Block volumes are PVCs of a CSI StorageClass (Rook-Ceph, Longhorn, NetApp, Huawei Dorado, Pure Storage), with CSI snapshots and cinder-backup backups.

GoAny block CSI

Glance

Images stored in block PVCs through CDI DataVolumes; the four interoperable import methods.

GoCDI and CSI

Manila

Multi-tenant NFS shares: one NFS-Ganesha gateway per share network, inside the tenant network.

GoNFS-Ganesha

Swift and S3

Object storage: Rook-Ceph and its RGW gateway for the S3 and Swift APIs.

SpecifiedRook-Ceph RGW

Pure Storage CSI

Go CSI driver for Pure Storage FlashArray over iSCSI: snapshots, clones, expansion, block RWX for KubeVirt. Prototype.

GoFlashArray over iSCSI

Neutron

Networks, subnets, ports, routers and security groups written to the OVN Northbound database; IPv4 and IPv6.

GoOVN and Open vSwitch

Octavia (OVN)

The Octavia v2 API served by neutron-api; OVN load balancers, enabled by default.

GoOVN load balancers

Neutron-FWaaS

Firewall groups, policies and rules (FWaaS v2).

GoOVN ACLs

Neutron-VPNaaS

Site-to-site IPsec VPN: IKE, IPsec policies, connections.

GoIPsec agent

OVN-BGP-Agent

Announces over BGP the VM and floating IPs reachable through the node.

GoFRR and OVN

Keystone

Multi-tenant identity: domains, projects, roles; tokens, OIDC, JWT, application credentials.

GoSQL, OIDC, JWT

Barbican

Secrets, secret containers and keys.

GoMariaDB, PKCS#11

Designate

Zones and recordsets published by ExternalDNS (one DNSEndpoint per recordset).

GoExternalDNS

CloudKitty

Rating (FinOps): usage collected from Prometheus, priced by hashmap rules and CEL scripts, rated history in InfluxDB; with openkeel-pricing (cost and carbon quotes), it feeds Skyline's FinOps / GreenOps page.

GoPrometheus, InfluxDB

Heat

Orchestration: no Go service yet; the stack and orchestration commands are rewritten in ok.

CLI only—

EC2 API

EC2 Query API (97 actions), SigV2 and SigV4 signatures checked by Keystone: AWS CLI, boto3, Terraform.

GoNova, Neutron, Cinder

Skyline

A single Go binary: the console API, the React console files, and a proxy to the Keystone catalog.

GoUpstream React console

ok (CLI)

The OpenStack client: the commands of python-openstackclient 10.3.1 and its plugins, with the same arguments, outputs and exit codes.

GoStatic Go binary

okadm

The deployment CLI: plan, install, upgrade, status, uninstall; kind lab or production.

Goclient-go, Helm SDK
All components

Deployed on Kubernetes, plug and play

okadm is a Go binary that embeds client-go, the Helm SDK and the OpenKeel charts. It checks the cluster, installs the missing operators, then the data services and the components in dependency order, and resumes where it stopped.

Discover okadm
okadm plan    --mode lab                                # does the cluster fit? what is missing?
okadm install --mode lab --create-kind --ingress --demo  # kind cluster, Traefik, Skyline, demo project
okadm status                                            # version, Helm releases, pod state
okadm upgrade --version 2026.2.1                        # one component at a time

FAQ

The essential answers to understand OpenKeel.

What is OpenKeel?

The sovereign French Cloud solution of the inherent group, with a European reach. It rewrites the OpenStack services in Go on top of Cloud Native technologies (Kubernetes, OVN, KubeVirt, CSI). Its REST APIs are compatible with OpenStack's and it deploys on Kubernetes with the okadm CLI.

Who is behind OpenKeel?

The inherent group, a French IT group expert in AI, cloud, cybersecurity and connectivity for businesses and public bodies.

Under which license is OpenKeel distributed?

The Apache License 2.0, the license of OpenStack: the code can be used, modified and redistributed, commercially too, with an explicit patent grant; the license and the copyright notices go with every copy, and changes are marked as such.

Is OpenKeel SecNumCloud qualified?

SecNumCloud (ANSSI) qualifies a service and its provider, not a piece of software. OpenKeel is designed to be SecNumCloud-ready: every internal flow in TLS, a CADF audit trail on every API, OpenStack RBAC, Barbican with an HSM, Kata isolation for containers, signed images with an SBOM on a controlled registry. What is compliant today and what is left to evolve, requirement by requirement, is on SecNumCloud-ready.

Do my OpenStack tools keep working?

Yes: each component keeps the paths, parameters, HTTP codes, error bodies, microversions and policies of the original. Clients, SDKs, Terraform, Tempest and Skyline see no difference. Known gaps are listed in each module's docs/CONFORMANCE.md.

All questions

Reverse-specs, diagrams and presentation

Specifications

38 reverse-specs

Endpoints, errors, interactions, scenarios and rewrite pack of each upstream repository.

Browse
Architecture

25 diagrams

Overview, platform, per service, per protocol and node placement.

See the views
Presentation

57-slide deck

The reference presentation of the project, as PowerPoint and PDF.

Download