OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Components · Networking
Networks, subnets, ports, routers and security groups written to the OVN Northbound database; IPv4 and IPv6.
OpenKeel implementation in Go of OpenStack neutron (neutron-api), generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. Scope: the Neutron core on ML2/OVN — networks, subnets (internal IPAM), ports with ML2 port binding and the binding-extended API used by Nova for live migration, security groups, routers (interfaces, gateway, extra routes) and floating IPs, plus quotas, tags, agents and availability zones read from the OVN Southbound database. Extensions (QoS, trunks, segments API, port forwarding, VPNaaS, BGP…) come later; their collections answer empty lists.
neutron-api also serves the Octavia v2 API (internal/lbaas, under /load-balancer): Python Octavia does not run, and openkeel-ovn-octavia-provider stays a separate service, the only back end. Design, seam and differences: docs/OCTAVIA.md.
The backend is a parallel OVN owned by Neutron (references/backends/neutron-ovn.md, design B): the service writes the OVN Northbound rows exactly as Python's ML2/OVN driver does — same tables, names, external_ids keys and options — because ovn-bgp-agent, ovn-octavia-provider and the OVN metadata agent stay in Python and read them. It turns Logical_Switch_Port.up into port status changes and sends Nova the network-vif-plugged / network-vif-unplugged / network-vif-deleted / network-changed external events.
It replaces the Python service without its clients noticing: same routes, status codes, NeutronError bodies and types, policies. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md.
github.com/openkeel/openkeel-neutronneutron-api (API on port 9696, health and metrics on 9090)Excerpt from openkeel-neutron/README.md (in English).
368 operations of the original REST API (routes and body actions), and their state in OpenKeel.
Python Neutron's ML2/OVN unit-test exchanges and Octavia's API exchanges are replayed against the Go service; contracts with Nova and OVN, Galera concurrency and a real data plane are tested.
The recorded exchanges of Python Neutron's ML2/OVN unit tests give the same status and body from the Go service.
make e2e on go-mysql-server, E2E_MYSQL_DSN for MariaDB 11.4; E2E_STRICT=1 passes with test/e2e/known-differences.txt.
Latest result 2344 / 2728 identical (86 %, 2026-10-31); 2331 / 2728 on MariaDB 11.4, the same files.
Source: openkeel-neutron/docs/CONFORMANCE.md
Port binding to an OVN chassis, port status, network-vif-plugged and other events, and the live-migration binding API behave as Nova expects.
TestNovaBootFlow in internal/app; client error types in TestErrorTypes.
Latest result Pass.
Source: openkeel-neutron/docs/CONFORMANCE.md
VNI and IP allocation stay unique when networks and ports are created through three Galera nodes at once.
make galera-test on a 3-node cluster.
Latest result Pass: 20 networks for 10 VNIs give 10 created with distinct VNIs; no duplicate address; no 5xx; every node reads the same allocations.
Source: openkeel-neutron/docs/CONFORMANCE.md
Routers, SNAT, floating IPs and load balancing work for real guests on OVN, with project isolation.
openkeel-lab/scripts/dataplane-test.sh (78 checks) after a cold make lab-up PROFILE=dataplane.
Latest result Pass (2026-11-01).
Source: openkeel-neutron/docs/CONFORMANCE.md
The Octavia v2 API served by neutron-api answers the recorded Python Octavia exchanges identically, provider calls included.
make e2e-lbaas on a MariaDB Galera node; E2E_STRICT=1 fails on any unexplained difference.
Latest result 8 598 / 8 691 identical; provider calls 3 826 / 3 831. Python's own replay gives 8 683 / 8 691.
Source: openkeel-neutron/docs/CONFORMANCE.md
The upstream Neutron API tests against the deployed service.
Not yet pointed at the lab's data plane.
Latest result Not run.
Source: openkeel-neutron/docs/CONFORMANCE.md
Neutron keeps its core API on ML2/OVN and also serves the Octavia API, so non-OVN agents, the separate Octavia service with its amphorae and unused notifications are gone.
Taken over by OVN
OVN does routing, DHCP, security groups and NAT itself; the ML2 mechanism driver is fixed to OVN, so L3, DHCP, OVS and Linux bridge agents and their privsep helpers are not needed.
The agents API lists OVN Southbound chassis only; PUT and DELETE on agents are acknowledged without effect. Networks, routers and floating IPs work as on ML2/OVN.
Source: openkeel-neutron/docs/CONFORMANCE.md
Taken over by OVN load balancers
The Octavia v2 API runs in the neutron-api binary with the OVN provider; there are no amphora VMs, and purge is an idempotent periodic task in each replica.
openstacksdk, the openstack client and octavia-tempest-plugin pass on the OVN provider. Amphora routes answer as an empty table.
Source: openkeel-neutron/docs/CONFORMANCE.md
The OVN provider refuses TLS listeners anyway, so no certificate manager is wired in this version.
TLS listener requests are validated, then answer 501 from the provider. TCP and UDP load balancing are unaffected; TLS can terminate in the backends.
Source: openkeel-neutron/docs/CONFORMANCE.md
OpenKeel's core has no consumer for network.create.end and similar events, such as Ceilometer.
Resources behave the same; consumers of these events receive nothing from Neutron. Every API call is still recorded in the CADF audit trail.
Source: openkeel-neutron/docs/CONFORMANCE.md
Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module
Service view generated by the diagram skill from the OpenKeel model.
Full screen| From | To | Protocol | What |
|---|---|---|---|
| Skyline | Neutron server | REST API | extensions, ports, FWaaS, VPN, load balancers |
| Nova API | Neutron server | REST API | ports |
| Neutron server | Nova API | REST API | network-vif-plugged |
| Neutron server | Neutron reconciler | SQL (MariaDB Galera) | reconciled from DB |
| Neutron reconciler | Kube-OVN | Kubernetes API | Vpc, Subnet, IP, SecurityGroup, OvnFip |
| Ironic conductor | Neutron server | REST API | provisioning/tenant ports |
| Heat engine | Neutron server | REST API | OS::Neutron::* |
| EC2 API | Neutron server | REST API | VPC, subnets, security groups |
| Neutron server | OVN Northbound DB | OVSDB | NB writes: switches, ports, routers, ACLs, NAT, DHCP; LSP.up monitor |
| Neutron server | OVN Southbound DB | OVSDB | SB reads: Chassis, Chassis_Private (liveness, binding) |
| Neutron reconciler | OVN Northbound DB | OVSDB | repairs drift (maintenance loop) |
| Neutron server | Neutron FWaaS | REST API | proxy /v2.0/fwaas/*, same token |
| Neutron server | Neutron VPNaaS | REST API | proxy /v2.0/vpn/*, vpn-agents, same token |
| Neutron VPNaaS | Neutron server | REST API | core and L3 calls: gateway ports, routes |
| Neutron server | OVN Octavia provider | REST API | Octavia driver API (:9877) |
| OVN Octavia provider | Neutron server | REST API | /internal/lbaas status updates, ports, subnets |
| Zun compute | Neutron server | REST API | ports bound to host (compute:zun) |
Branch stable-2026.2 · 8 files
Read the reverse-specThe Octavia v2 API served by neutron-api; OVN load balancers, enabled by default.
Firewall groups, policies and rules (FWaaS v2).
Site-to-site IPsec VPN: IKE, IPsec policies, connections.
Announces over BGP the VM and floating IPs reachable through the node.