OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Identity and security
Multi-tenant identity: domains, projects, roles; tokens, OIDC, JWT, application credentials.
OpenKeel implementation in Go of OpenStack keystone (keystone-api), generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. It replaces the Python service without its clients noticing: same routes, status codes, error bodies, microversions and policies. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md.
github.com/openkeel/openkeel-keystonekeystone-api (API on port 5000, health and metrics on 9090) and keystone-customers (the controller of the OpenKeelCustomer resources, below)Excerpt from openkeel-keystone/README.md (in English).
259 operations of the original REST API (routes and body actions), and their state in OpenKeel.
Python Keystone's recorded unit-test exchanges are replayed against the Go service; the Go Keystone is also used by Skyline, the CLIs and every other service on the lab.
The exchanges recorded from Python Keystone's tests give the same status and body from the Go service.
make e2e; report in test/e2e/report.json, accepted differences in test/e2e/known-differences.txt.
Latest result 7345 / 8896 requests identical in the last report (1489 files).
Source: openkeel-keystone/test/e2e/report.json
Unit tests, including the EC2 and S3 signature vectors of test_contrib_s3_core ported by hand.
make test (vet and race detector); internal/keystone/ec2sign_test.go, internal/api/s3tokens_test.go.
Source: openkeel-keystone/docs/CONFORMANCE.md
Login, profile, policies, project switch, regions, domains, endpoints, wrong-password text and logout work as against Python.
Live run of openkeel-skyline against a MariaDB-seeded Go Keystone.
Latest result System admin policies: 1 817 / 1 860 allowed, as Python against its fake.
Source: openkeel-skyline/docs/CONFORMANCE.md
Project- and system-scoped admin tokens and a catalog listing every expected service, used by the other services' checks.
make lab-smoke runs labctl smoke in the lab cluster.
Source: openkeel-lab/README.md
Keystone keeps its API and leaves out the oslo service plumbing and the basic notification format, auditing with CADF events instead.
Only CADF, the upstream default, is implemented; events go through the audit emitter (JSON on stdout, oslo.messaging when enabled).
Setting basic logs a warning and CADF is sent. No OpenKeel service consumes Keystone's basic payloads.
Source: openkeel-keystone/docs/CONFORMANCE.md
Taken over by Kubernetes probes, OpenTelemetry, Ingress
Logs go to stdout as JSON, traces to OpenTelemetry, health to Kubernetes probes and CORS to the ingress.
Operators use the cluster's tooling; the identity API is unchanged.
Source: openkeel-keystone/config/dropped-options.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Skyline | Keystone | REST API | login, catalog, system session |
| @api | Keystone | REST API | token validation |
| Keystone | OIDC identity provider | OIDC / JWKS | OIDC discovery, JWKS |
| Heat engine | Keystone | REST API | trusts, stack domain users |
| EC2 API | Keystone | REST API | ec2tokens (SigV4) |
| Ceph RGW | Keystone | REST API | token validation, /v3/s3tokens (user rgw) |
| OVN Octavia provider | Keystone | REST API | service token |
Branch stable-2026.2 · 9 files
Read the reverse-specBranch stable-2026.2 · 9 files
Read the reverse-specBranch stable-2026.2 · 9 files
Read the reverse-specBranch master · 9 files
Read the reverse-specBranch stable-2026.2 · 9 files
Read the reverse-spec