OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Storage
Block volumes are PVCs of a CSI StorageClass (Rook-Ceph, Longhorn, NetApp, Huawei Dorado, Pure Storage), with CSI snapshots and cinder-backup backups.
OpenKeel implementation in Go of OpenStack Cinder, the Block Storage API v3, generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. It replaces the Python service without its clients noticing (Nova, Glance's cinder store, python-cinderclient, Skyline): same routes, status codes, error bodies, microversions 3.0–3.71 and policies. Volumes are Kubernetes PVCs on a block CSI StorageClass (Longhorn by default), snapshots and backups are CSI VolumeSnapshots, volumes from images are CDI clones, and attachments are KubeVirt hotplugs. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md; the build plan with the status of every operation is in docs/PLAN.md.
github.com/openkeel/openkeel-cindercinder-api | REST API v3; also -migrate for the database migrations | 8776, admin 9090 | | cinder-scheduler | places volumes on backends and backups on backup hosts, purges expired reservations and messages | admin 9090 | | cinder-volume | drives PVCs, VolumeSnapshots, DataVolumes and PV handovers for the volumes of its backends | admin 9090 | | cinder-backup | creates, deletes and restores backups (VolumeSnapshots of the backup class) | admin 9090 | The workers poll the database for transient statuses and elect one active replica each with a Kubernetes Lease.Excerpt from openkeel-cinder/README.md (in English).
218 operations of the original REST API (routes and body actions), and their state in OpenKeel.
Python Cinder's functional-test exchanges are replayed against the Go service, Nova's attachment contract is tested, and concurrency is checked on Galera.
967 exchanges of 196 Python functional tests give the same status and body, with the functional-test fixture emulated.
make e2e, on go-mysql-server and MariaDB 11.4 (E2E_MYSQL_DSN); E2E_STRICT=1 passes with test/e2e/known-differences.txt.
Latest result 832 / 967 identical (834 on MariaDB); in scope only 832 / 854 (97.4 %), the rest being groups and manage (out of scope).
Source: openkeel-cinder/docs/CONFORMANCE.md
Attachments API at 3.44, idempotent update and delete, service-token rule and error statuses that Nova maps match its expectations.
TestNovaAttachmentFlow, router tests and TestQuotaExceeded.
Latest result Tested; os-reimage and Nova external events implemented but not replayed against Nova.
Source: openkeel-cinder/docs/CONFORMANCE.md
Policy personas on 161 of the 167 default rules, quota and transfer vectors, router rules and the CSI driver behave as specified.
go test ./... (13 packages), CSI driver on client-go fakes.
Latest result All pass.
Source: openkeel-cinder/docs/CONFORMANCE.md
Quota and reservation hold when creations arrive through three Galera nodes at once.
make galera-test on a 3-node cluster: 30 creations for a quota of 10, 9 concurrent os-reserve.
Latest result Pass, 3 runs out of 3: exactly 10 × 202, 20 × 413, no 5xx; one os-reserve winner.
Source: openkeel-cinder/docs/CONFORMANCE.md
Tempest tempest/api/volume, cinder-tempest-plugin and replays of cinderclient, Nova and Glance store calls.
Need a kind cluster with Keystone, Longhorn, CDI and KubeVirt; no recorded client invocations exist.
Latest result Not run.
Source: openkeel-cinder/docs/CONFORMANCE.md
Cinder keeps the volume API but delegates the data path to CSI (Longhorn by default), which removes vendor drivers, backend migration and replication, and the RPC topology.
Taken over by CSI (Longhorn by default)
Every backend is a CSI StorageClass with CSI snapshots and KubeVirt hotplug; connection info is a kubernetes_pvc that the OpenKeel Nova consumes.
Nova, Glance's cinder store, cinderclient and Skyline use the same API. Any storage with a CSI driver can be a backend.
Source: openkeel-cinder/docs/CONFORMANCE.md
Taken over by CSI
Data copy between StorageClasses goes through retype with the on-demand migration policy.
os-migrate_volume answers 400 with a message pointing to os-retype, which moves the data.
Source: openkeel-cinder/docs/CONFORMANCE.md
Taken over by CSI
CSI backends have no Cinder-managed replication.
failover_host answers 400 'no replication target configured'. Redundancy is the storage backend's own, configured outside the Cinder API.
Source: openkeel-cinder/docs/CONFORMANCE.md
Taken over by Longhorn encrypted volumes
Encryption is done by the StorageClass, so Cinder's path needs no key manager.
Encrypted volume types still work; a fixed key id is recorded and hidden from 3.64 views.
Source: openkeel-cinder/docs/CONFORMANCE.md
The API records the transient status and the workers poll the database; CSI drivers report no capacity, so there is one pool per backend and AZ.
Volume states and API answers are unchanged; interrupted operations are resumed by the next pass, so workers/cleanup returns empty lists.
Source: openkeel-cinder/docs/CONFORMANCE.md
Taken over by Kubernetes Leases
Each worker holds one Kubernetes Lease, so Cinder's active-active clusters do not exist.
Cluster and os-hosts lists are empty and writes answer 501; high availability comes from the Lease takeover.
Source: openkeel-cinder/docs/CONFORMANCE.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Skyline | Cinder API | REST API | aggregated lists |
| Nova API | Cinder API | REST API | volume attach |
| Cinder API | Nova API | REST API | volume events |
| Cinder API | Glance | REST API | volume from image |
| Cinder API | Cinder volume driver | RabbitMQ | RPC create/attach |
| Cinder volume driver | CSI driver (Longhorn) | Kubernetes API | PVC (Block), VolumeSnapshot |
| Cinder volume driver | KubeVirt | Kubernetes API | volume hotplug |
| Heat engine | Cinder API | REST API | OS::Cinder::* |
| EC2 API | Cinder API | REST API | volumes, snapshots |
| Zun compute | Cinder API | REST API | attachments → kubernetes_pvc |
Branch stable-2026.2 · 8 files
Read the reverse-specImages stored in block PVCs through CDI DataVolumes; the four interoperable import methods.
Multi-tenant NFS shares: one NFS-Ganesha gateway per share network, inside the tenant network.
Object storage: Rook-Ceph and its RGW gateway for the S3 and Swift APIs.
Go CSI driver for Pure Storage FlashArray over iSCSI: snapshots, clones, expansion, block RWX for KubeVirt. Prototype.