OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Identity and security
Secrets, secret containers and keys.
OpenKeel implementation in Go of OpenStack Barbican (key manager), generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. It replaces the Python service without its clients noticing: same routes, status codes, error bodies, microversions and policies. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md.
github.com/openkeel/openkeel-barbicanbarbican-api | barbican-wsgi-api | REST API on port 9311, health and metrics on 9090; -migrate applies the schema | | barbican-worker | barbican-worker | processes orders (key and asymmetric generation) from RabbitMQ, oslo.messaging wire format | | barbican-keystone-listener | barbican-keystone-listener | deletes a project's resources on Keystone's identity.project.deleted notification | | barbican-manage | barbican-manage | db upgrade/clean/sync_secret_stores, simple_crypto rewrap_pkek/new_pkek/rewrap_secrets, hsm gen_mkek/check_mkek/gen_hmac/check_hmac/rewrap_pkek | barbican-retry is not ported (no retry is ever scheduled on this branch, CONFORMANCE.md).simple_crypto (Fernet, master KEK file), p11_crypto (PKCS#11 HSM, cgo build only, below), vault_plugin (Vault or OpenBao KV v1/v2). The database is shareable with Python Barbican (Alembic head 8c74e2d7f1ff).Excerpt from openkeel-barbican/README.md (in English).
57 operations of the original REST API (routes and body actions), and their state in OpenKeel.
Barbican is checked by replay, by Barbican's own functional tests, by sending the same requests to Python and Go, and by running both side by side on one database and bus.
The recorded functional exchanges give the same answers from the Go service.
make e2e-strict on the embedded engine and on MariaDB 11.4.
Latest result 2 766 / 2 792 equal, 26 known differences (random keys, recorded dates, shared database); all pass live.
Source: openkeel-barbican/docs/CONFORMANCE.md
Barbican's upstream functionaltests/ pass against the Go service with a real Keystone.
test/functional/run_functional.py --target go through the conformance adapter.
Latest result 563 ok, 0 failures, 69 skipped.
Source: openkeel-barbican/docs/CONFORMANCE.md
The same requests sent to Python and Go Barbican, sharing one Keystone, get the same answers.
test/functional/diff_probe.py, and --new-defaults for the RBAC defaults.
Latest result Legacy policies 804 / 833, 29 deliberate differences; enforce_new_defaults 378 / 378.
Source: openkeel-barbican/docs/CONFORMANCE.md
Every policy decision of oslo.policy and the encrypted storage format of Python Barbican are reproduced.
make test on policy-vectors.json.gz and the simple_crypto and p11_crypto vectors.
Latest result Policy 40 704 / 40 704; simple_crypto 25 / 25; p11_crypto 8 / 8 emulated, 4 / 8 on SoftHSM 2. No real HSM tested.
Source: openkeel-barbican/docs/CONFORMANCE.md
Python and Go share one MariaDB and RabbitMQ: cross reads of every secret type, orders both ways, barbicanclient, castellan and openstack secret.
test/functional/interop.py; test/amqp/run.sh with oslo.messaging on RabbitMQ 3.13 and 4.4.
Latest result Interop 75 / 75; AMQP 3 / 3.
Source: openkeel-barbican/docs/CONFORMANCE.md
Writes through one node and through three nodes stay consistent.
make galera-test: TestOneWriteNode, TestThreeWriteNodes.
Latest result Pass, 3 runs each.
Source: openkeel-barbican/docs/CONFORMANCE.md
Barbican keeps its full API and the simple_crypto, PKCS#11 and Vault stores, and leaves out the dead retry process, Dogtag and the oslo plumbing.
On this branch no code path schedules a retry: the process only polls an always-empty table.
None: orders are processed by barbican-worker as upstream.
Source: openkeel-barbican/docs/CONFORMANCE.md
It needs a Dogtag server and its Python client, and certificate orders are disabled upstream on this branch.
Secrets use simple_crypto, an HSM through PKCS#11 or Vault. Certificate tables exist but are left untouched.
Source: openkeel-barbican/docs/CONFORMANCE.md
Taken over by Kubernetes probes
Logs go to stdout, health to Kubernetes probes, diagnostics to pprof on the admin listener.
The key manager API is unchanged.
Source: openkeel-barbican/config/dropped-options.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Nova API | Barbican | REST API | encryption keys |
| Glance | Barbican | REST API | image signatures |
Branch stable-2026.2 · 9 files
Read the reverse-spec