Components · Console and tools

ok (CLI)

The OpenStack client: the commands of python-openstackclient 10.3.1 and its plugins, with the same arguments, outputs and exit codes.

Go Static Go binaryopenkeel-ok

The module

ok is the OpenStack client of OpenKeel: the commands of the Python openstack CLI (python-openstackclient 10.3.1, branch stable/2026.2) and of its plugins, in one static Go binary.

Service	Command groups	Python reference
Nova	`server`, `flavor`, `keypair`, `aggregate`, `hypervisor`... (`openstack.compute.v2`)	python-openstackclient
Keystone	`project`, `user`, `role`, `token`, `federation`... (`openstack.identity.v3`, `.v2`)	python-openstackclient
Glance	`image` (`openstack.image.v2`, `.v1`)	python-openstackclient
Cinder, cinder-backup	`volume`, `volume backup`, `block storage`... (`openstack.volume.v3`, `.v2`)	python-openstackclient
Neutron	`network`, `subnet`, `port`, `router`, `security group`... (`openstack.network.v2`)	python-openstackclient
neutron-fwaas, neutron-vpnaas, BGP VPN, dynamic routing, TaaS	`firewall group`, `vpn`, `bgpvpn`, `bgp`, `tap`...	python-openstackclient
Neutron logs, SFC	`network log`, `sfc`	python-neutronclient
Octavia (served by neutron-api in OpenKeel)	`loadbalancer`	python-octaviaclient
Swift (Ceph RGW in OpenKeel)	`object`, `container`	python-openstackclient
Placement	`resource provider`, `allocation`, `trait`...	osc-placement
Ironic	`baremetal`	python-ironicclient
Barbican	`secret`, `acl`, `ca`	python-barbicanclient
Designate	`zone`, `recordset`, `ptr`, `tld`...	python-designateclient
Manila	`share`	python-manilaclient
Heat	`stack`, `orchestration`	python-heatclient
Masakari	`segment`, `notification`	python-masakariclient
cross-service	`quota`, `limits`, `availability zone`, `extension`, `versions`, `project cleanup`	python-openstackclient

Compatibility contract: the command names, arguments, defaults, output formats (-f table|json|yaml|value|csv|shell, -c, --sort-column...), error messages, exit codes and HTTP requests are those of openstack, so scripts keep working. Configuration is read the same way: clouds.yaml, secure.yaml (./, ~/.config/openstack/, the platform config directory, /etc/openstack/), OS_* variables and --os-* options, with the same precedence. okadm --export-config writes a clouds.yaml that ok uses as is. The exceptions are listed in docs/CONFORMANCE.md (upstream defects that ok fixes, no interactive shell).

export OS_CLOUD=openkeel
ok server list
ok network create private --description "lab network" -f json
ok loadbalancer create --vip-subnet-id private-subnet --name lb1

Note: until the rename to okadm, ok was the name of the OpenKeel installer. ok install, ok plan and the other lifecycle commands are now okadm install, okadm plan...

Excerpt from openkeel-ok/README.md (in English).

How compatibility is tested

ok is compared with the Python openstack CLI: same command lines parsed, same output formats, and both CLIs run against the same fake cloud and then on the OpenKeel lab.

Differential test

Differential against the Python CLI

Python openstack and ok, run against the same fake cloud, give the same exit code, stdout, stderr and every request sent.

How it runs

4,142 cases over the command catalogue with canned responses; method, path, query, body and microversion headers compared.

Latest result 4,059 compare everything; 83 skip a part, each with a note.

Source: openkeel-ok/docs/CONFORMANCE.md

Unit and golden tests

Argument parsing

Command lines parse into the same namespace, or the same error, as Python's argparse.

How it runs

9,500 synthetic command lines over every command (internal/argparse).

Latest result Identical namespace or error.

Source: openkeel-ok/docs/CONFORMANCE.md

Unit and golden tests

Output formatters and configuration

table, json, yaml, csv, value and shell outputs are byte-identical; clouds.yaml and OS_* resolution matches osc-lib.

How it runs

13 golden results from cliff and PyYAML (internal/output); 19 configuration scenarios (internal/app).

Latest result Byte for byte; 1,325 commands of 25 groups implemented.

Source: openkeel-ok/docs/CONFORMANCE.md

End to end on a lab

End to end on the OpenKeel lab

ok and openstack run side by side on read commands over every installed service, then a write cycle with ok.

How it runs

Lab installed by okadm install --mode lab, reached through kubectl port-forward and endpoint overrides.

Latest result 37 / 42 read commands identical (the 5 others: Python plugins ignore endpoint overrides); write cycle without error; server create --wait not concluded (2026-11-02).

Source: openkeel-ok/docs/CONFORMANCE.md

Left out of the rewrite

ok reproduces the commands, arguments and output of the openstack CLI and its plugins in one static binary, without the interactive shell or Python plugin loading.

Internal machinery simplified

Interactive cmd2 shell

Why it was left out

ok is meant for scripts and one-shot commands.

Why the solution is not affected

ok without a command prints an error; every command still runs from the shell with identical arguments and output.

Source: openkeel-ok/docs/CONFORMANCE.md

Internal machinery simplified

Python plugins installed separately

Why it was left out

The command groups of python-openstackclient and of the client plugins (Placement, Octavia, Ironic, Barbican, Designate, Manila, Heat, Masakari) are compiled into one Go binary.

Why the solution is not affected

No virtualenv or plugin installation; 1,325 commands are present. module list reports ok's Go modules instead of Python packages.

Source: openkeel-ok/README.md

Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module