OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Storage
Images stored in block PVCs through CDI DataVolumes; the four interoperable import methods.
OpenKeel implementation in Go of OpenStack Glance, the image service, generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. It replaces the Python service without its clients noticing (Nova, Cinder, glanceclient/OpenStackClient, Skyline): same routes, status codes, webob error pages, policies, image state machine, data path (md5 + multihash, format inspection) and the four interoperable import methods. Image data lives in PVCs of a block StorageClass (Longhorn by default) through CDI DataVolumes. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md.
github.com/openkeel/openkeel-glanceglance-api (API on port 9292, health and metrics on 9090, import tasks in its task pool), glance-scrubber (delayed delete), glance-manage (db sync, db load_metadefs)csi (CDI DataVolume img-<image id> in namespace openkeel-images, shared with openkeel-cinder and openkeel-nova; the uploaded bytes are also kept as sent on a ReadWriteMany volume, so downloads match the checksums of qcow2/vmdk images that CDI converts to raw), file (development, tests, staging), http (read-only locations)Excerpt from openkeel-glance/README.md (in English).
83 operations of the original REST API (routes and body actions), and their state in OpenKeel.
Python Glance's functional tests were re-recorded with their per-request configuration and replayed against the Go service; client expectations and Galera concurrency are checked too.
The exchanges of 239 Python functional tests, with their configuration overrides and policy rules, give the same answers.
make e2e on go-mysql-server and MariaDB 11.4; make e2e-strict passes with test/e2e/known-differences.txt (116 files, each with its reason).
Latest result 1988 / 2442 identical (81.4 %) on both engines; the main gap is the image cache, out of scope.
Source: openkeel-glance/docs/CONFORMANCE.md
Version list, locations API for Nova and Cinder, 204 downloads, hashes, error pages, JSON-patch types, copy-image and image schema match what the clients expect.
Checked against reverse-spec 07 § 4 expectations, through the replay and the handlers.
Latest result All met; v2.14 (cache) is never listed.
Source: openkeel-glance/docs/CONFORMANCE.md
Import lock, upload status, same-id image and same-name namespace creations have one winner through three nodes.
make galera-test on a 3-node cluster.
Latest result 4 / 4: exactly one winner, no error escapes the retries, every node reads the same state.
Source: openkeel-glance/docs/CONFORMANCE.md
The service builds, passes static checks and its unit tests.
go build ./..., go vet ./..., go test ./....
Latest result Pass.
Source: openkeel-glance/docs/CONFORMANCE.md
Glance keeps the image API and the four import methods but stores images through CDI on CSI, which removes the image cache, the other store drivers and qemu-img conversion.
Taken over by CDI
Image data is cloned by CDI into volumes; a per-node file cache has no use.
/v2/cache answers 404 as on a Glance without cache, and glanceclient reports cache commands as not supported. Boot from image is served by CDI clones.
Source: openkeel-glance/docs/CONFORMANCE.md
Taken over by CDI, CSI (Longhorn)
The csi store keeps images as CDI DataVolumes on a configurable StorageClass, behind the same store contract; file and http remain for tests and read-only locations.
Nova, Cinder, OpenStackClient and Skyline see the same API; storage choice moves to the StorageClass.
Source: openkeel-glance/docs/CONFORMANCE.md
Taken over by CDI
The image is distroless and CDI already converts qcow2 and vmdk to raw on the csi store.
The plugin cannot be configured, but images are still converted for VMs; the uploaded original is kept and served on download by default.
Source: openkeel-glance/docs/CONFORMANCE.md
Import tasks run in a goroutine pool of the replica instead of taskflow threads.
Same task semantics, import lock and expiry; the replay shows timing differences only.
Source: openkeel-glance/config/dropped-options.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Skyline | Glance | REST API | images |
| Nova API | Glance | REST API | image metadata |
| Cinder API | Glance | REST API | volume from image |
| Glance | Barbican | REST API | image signatures |
| Glance | Glance store driver | REST API | in-process driver |
| Glance store driver | CDI | Kubernetes API | DataVolume upload (upload proxy), import, clone |
| Ironic conductor | Glance | REST API | image download (cache) |
| EC2 API | Glance | REST API | AMIs |
| Glance store driver | KubeVirt | Kubernetes API | VirtualMachineExport (download without keep_original) |
Branch stable-2026.2 · 8 files
Read the reverse-specBlock volumes are PVCs of a CSI StorageClass (Rook-Ceph, Longhorn, NetApp, Huawei Dorado, Pure Storage), with CSI snapshots and cinder-backup backups.
Multi-tenant NFS shares: one NFS-Ganesha gateway per share network, inside the tenant network.
Object storage: Rook-Ceph and its RGW gateway for the S3 and Swift APIs.
Go CSI driver for Pure Storage FlashArray over iSCSI: snapshots, clones, expansion, block RWX for KubeVirt. Prototype.