Nova → KubeVirt
Instances are VirtualMachines; CDI imports the images
Learn moreArchitecture
Overview
Clients, Go APIs, workers and agents, shared infrastructure, operators, the Kubernetes platform and external systems.
Services, data and platform
Full screenDon't rewrite what is complex
Each service relies on a proven Kubernetes building block; Ironic is the exception, upstream Python in an OpenKeel chart.
Cinder → block CSI
Volumes are PVCs on any block CSI: Rook-Ceph, Longhorn, NetApp, Dorado, Pure
Learn moreManila → NFS-Ganesha
NFS gateway created on demand in the tenant network, on a block CSI volume
Learn moreNeutron → OVN
VM network isolated from the Kubernetes network (Multus)
Learn moreSwift / S3 → Ceph
Rook-Ceph and its RGW gateway
Learn moreDesignate → ExternalDNS
Zones and records published by ExternalDNS
Learn moreMasakari → Medik8s
Node Healthcheck and Self Node Remediation
Learn moreIronic stays in Python
Too many hardware configurations to test
Learn moreTenant isolation: the closed paths
A VM has no interface on the Kubernetes CNI network: each NIC is plugged into its own Neutron port in OpenKeel's OVN. A guard installed by the CNI plugin closes the paths through the namespaces it shares.
| Path | Why it is closed |
|---|---|
| Guest to another tenant network | The tap's only exit is the in-Pod bridge and the veth to br-int; ovn-controller maps it to one logical port. Other switches are reachable only through a Neutron router |
| Guest to the Pod network, the node, cluster Services | No interface of the guest touches them, and the guard closes the way through the shared namespaces |
| Spoofed MAC or IP | port_security of the logical port, written by Neutron |
| Another project's port | A project can create neither Pods nor NADs; only the service role can bind a port |
Source: openkeel-neutron/docs/VM-NETWORKING.md (§ Tenant isolation). make test-cni replays the attack in real namespaces, with and without the guard.