OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Compute and capacity
Bare metal: stays upstream Python, packaged in an OpenKeel chart; too many hardware configurations to test.
Upstream OpenStack Ironic (Python, 2026.2) in OpenKeel: a Helm chart, not a Go rewrite. Design, decisions and evidence are in openkeel-docs/IRONIC-DESIGN.md.
Excerpt from openkeel-ironic/README.md (in English).
131 operations of the original REST API (routes and body actions), and their state in OpenKeel.
Ironic stays the upstream Python service in a Helm chart; tests check that it works through Go Keystone, the standard client and Go Nova, on a fake Redfish machine.
openstack baremetal through Go Keystone enrols a sushy-tools machine, walks it to available, deploys to wait call-back and undeploys.
openkeel-ironic/test/smoke.sh from a client pod (python-ironicclient 6.3.0) on a kind cluster.
Latest result Verified (2026-10-31). No machine boots: IPA and active are not covered.
Source: openkeel-docs/IRONIC-DESIGN.md
The chart installed by okadm install --components ironic passes the smoke test in both deployment modes.
okadm install in lab mode (kind, 3 nodes) and production mode (3 API, 2 conductors, Galera 3), then smoke.sh on each.
Latest result Run on 2026-11-02; production on kind needed two test-only additions (DNS NetworkPolicy workaround, automated_clean: false).
Source: openkeel-docs/IRONIC-DESIGN.md
openstack server create with a bare metal flavor drives Ironic through Go Nova, and delete frees the node.
openkeel-ironic/test/nova.sh on a lab with Nova and Ironic, Neutron flat and sushy-tools.
Latest result Verified on kind up to wait call-back; a real machine, IPA, the config drive and active not verified.
Source: openkeel-nova/docs/CONFORMANCE.md
Ironic stays upstream Python in an OpenKeel chart, deployed without RabbitMQ, Swift temporary URLs or the Kolla start-up scripts.
Ironic needs RabbitMQ for nothing else; json-rpc on the conductor's port 8089, with per-Pod DNS names from the StatefulSet, does the same job.
API and conductor behave as upstream; notifications stay off. JSON-RPC is not yet encrypted, and a NetworkPolicy limits it to the API.
Source: openkeel-docs/IRONIC-DESIGN.md
OpenKeel has no Swift service of its own.
Images and config drives are served by the conductor's HTTP server (image_download_source http, configdrive_use_object_store false), so deployment still works.
Source: openkeel-docs/IRONIC-DESIGN.md
Taken over by Kubernetes
The Kolla images are pinned by digest and their binaries run directly, configured from a ConfigMap, without kolla_start or sudo.
Same Ironic code; the API and conductor run unprivileged with a read-only root and no capabilities.
Source: openkeel-docs/IRONIC-DESIGN.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Nova conductor + scheduler | Ironic API | REST API | bare metal flavors: provision nodes |
| Nova compute agent | Ironic API | REST API | nodes → Placement inventory (planned) |
| Ironic API | Ironic conductor | REST API | JSON-RPC deploy/clean/power |
| Ironic conductor | BMCs and switches | REST API | Redfish power, virtual media |
| Ironic conductor | ironic-python-agent | REST API | agent API: write image, clean, inspect |
| ironic-python-agent | Ironic API | REST API | lookup, heartbeat |
| Ironic conductor | Glance | REST API | image download (cache) |
| Ironic conductor | Neutron server | REST API | provisioning/tenant ports |
Branch stable-2026.2 · 9 files
Read the reverse-specResource inventories and allocations; the first component rewritten in Go.
Instances run as KubeVirt VirtualMachines; conductor with the scheduler in process, one agent per node.
Containers as a Service: one Pod per container, isolated in its own Kata microVM, with its Neutron port as its only network.
Instance high availability; node health from Node Healthcheck and Self Node Remediation.