Components · Services and orchestration

EC2 API

EC2 Query API (97 actions), SigV2 and SigV4 signatures checked by Keystone: AWS CLI, boto3, Terraform.

Go Nova, Neutron, Cinderopenkeel-ec2-api

The module

OpenKeel implementation in Go of OpenStack ec2-api (ec2-api), generated from the reverse-specification of branch 17.0.0 by the generate-go-from-spec skill. It replaces the Python service without its clients noticing: the same EC2 Query API (97 actions of ec2-api 17.0.0, SigV2 and SigV4 verified by Keystone ec2tokens), the same XML documents and error codes, the same EC2 identifiers and the same ec2api database. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md.

Clients: the AWS CLI and boto3, Terraform's AWS provider with a custom endpoint, euca2ools/boto2
Backends: Nova, Neutron (with VPNaaS for the VPN actions), Cinder and Glance, called with the caller's token; the EC2 IDs and tags are in MariaDB (items, tags). Not included: ec2-api-metadata (Nova's metadata service or cloud-init serves instances) and ec2-api-s3 (Swift s3api) — docs/CONFORMANCE.md D9, D10
Go module: github.com/openkeel/openkeel-ec2-api
Binary: ec2-api (API on port 8788, health and metrics on 9090)
Configuration: YAML, see config/config.example.yaml
Setting up a development environment, the database and the tests: docs/GETTING-STARTED.md
Database schema, migrations and upgrades: docs/DATABASE.md

Excerpt from openkeel-ec2-api/README.md (in English).

API actions

100 actions of the original API, and their state in OpenKeel.

100Implemented

See every operation

How compatibility is tested

The retired ec2-api is checked against its recorded behaviour and, above all, against the real AWS clients: the AWS CLI and Terraform's AWS provider.

Replay of recorded exchanges

Recorded validation errors and probes

Recorded error exchanges give the same status, EC2 code and message; dispatcher probes compare plain-text errors and response roots.

How it runs

test/e2e/exchanges_test.go and test/e2e/probes_test.go.

Latest result 40 / 40 identical; probes 9 byte-identical, 6 deliberately different (2026-11-02).

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Scenario

Scenario of all action families

Every action family runs, and response shapes are checked against those recorded from Python.

How it runs

test/e2e/scenario_test.go.

Latest result 97 / 97 actions pass; 93 response shapes checked, no unexplained element (2026-11-02).

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Client contract

AWS CLI v2

The real AWS CLI works through 42 actions, with SigV4 verified by keystoneclient's algorithm.

How it runs

test/awscli (build tag awscli), AWS CLI v2 2.18.

Latest result Pass (2026-11-02).

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Client contract

Terraform AWS provider

Terraform applies a VPC, subnet, gateway, routes, security group, key pair, instance, EIP and volume, then plans no changes and destroys.

How it runs

test/terraform (build tag terraform), Terraform 1.5.4 and hashicorp/aws 5.100.0, on MariaDB.

Latest result Pass on MariaDB (2026-11-02).

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Concurrency on Galera

Concurrency on MariaDB Galera

One default VPC and one EC2 ID per server under concurrent requests on three nodes; tag writes converge.

How it runs

test/galera (build tag galera) on a 3-node cluster.

Latest result Pass, 3 runs, no 5xx (2026-11-02).

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Tempest

ec2api-tempest-plugin

The upstream Tempest plugin of the project.

How it runs

Retired with the project upstream.

Latest result Not run.

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Left out of the rewrite

The EC2 API (retired upstream in 2024) keeps its actions but drops its own S3 server and metadata service, which the platform already provides.

Done by the Cloud Native platform

ec2-api-s3 server

Taken over by Rook-Ceph RGW

Why it was left out

The Python S3 server is unauthenticated; object storage with S3 comes from the platform.

Why the solution is not affected

S3 clients use the RGW endpoint with Keystone EC2 credentials (okadm --ceph-s3).

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Done by the Cloud Native platform

ec2-api-metadata service

Taken over by KubeVirt (cloud-init)

Why it was left out

Instances get metadata from cloud-init's OpenStack and NoCloud datasources (config drive).

Why the solution is not affected

Guests boot and configure as usual; only the EC2 identifiers (i-, ami-, r-) are missing from their metadata.

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Internal machinery simplified

Per-host default-VPC file lock

Why it was left out

Several replicas and multi-writer Galera need a cluster-wide lock: a database row with an expiry.

Why the solution is not affected

Default VPCs are still created once per project, now safely across replicas.

Source: openkeel-ec2-api/docs/CONFORMANCE.md

Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module

EC2 API interactions

Service view generated by the diagram skill from the OpenKeel model.

The 5 interactions of the model

From	To	Protocol	What
EC2 API	Keystone	REST API	ec2tokens (SigV4)
EC2 API	Nova API	REST API	instances
EC2 API	Neutron server	REST API	VPC, subnets, security groups
EC2 API	Cinder API	REST API	volumes, snapshots
EC2 API	Glance	REST API	AMIs

Specifications

Services

ec2-api

Branch 17.0.0 · 9 files

Read the reverse-spec

Also in Services and orchestration

Designate

Zones and recordsets published by ExternalDNS (one DNSEndpoint per recordset).

GoExternalDNS

CloudKitty

Rating (FinOps): usage collected from Prometheus, priced by hashmap rules and CEL scripts, rated history in InfluxDB; with openkeel-pricing (cost and carbon quotes), it feeds Skyline's FinOps / GreenOps page.

GoPrometheus, InfluxDB

Heat

Orchestration: no Go service yet; the stack and orchestration commands are rewritten in ok.

CLI only—