OpenKeel: die souveräne französische Cloud-Lösung mit europäischer Reichweite der inherent-Gruppe inherent entdecken
Architektur
Alle in der Übersicht dargestellten Interaktionen, nach Protokoll, wie vom Diagramm-Skill erzeugt.
overview| From | To | Protocol | What |
|---|---|---|---|
| Cinder API | Cinder volume driver | AMQPS (RabbitMQ RPC / notifications) | RPC create/attach |
| Designate API | Designate worker + sink | AMQPS (RabbitMQ RPC / notifications) | RPC zone/recordset |
| Heat API | Heat engine | AMQPS (RabbitMQ RPC / notifications) | RPC stack create/update |
| Manila API | Manila share driver | AMQPS (RabbitMQ RPC / notifications) | RPC create/extend |
| Masakari API | Masakari engine + monitors | AMQPS (RabbitMQ RPC / notifications) | RPC notification |
| Nova API | Nova conductor + scheduler | AMQPS (RabbitMQ RPC / notifications) | RPC build/resize |
| Nova conductor + scheduler | Nova compute agent | AMQPS (RabbitMQ RPC / notifications) | RPC |
| RabbitMQ cluster | Designate worker + sink | AMQPS (RabbitMQ RPC / notifications) | sink: Nova/Neutron events |
| all api services | RabbitMQ cluster | AMQPS (RabbitMQ RPC / notifications) | versioned notifications |
| Keystone | OIDC identity provider | OIDC / JWKS over HTTPS | OIDC discovery, JWKS |
| CSI driver (Longhorn) | Cluster nodes | Data path (disks, NICs, DNS answers) | replicas on node disks |
| CSI driver (Longhorn) | Swift storage | Data path (disks, NICs, DNS answers) | XFS devices, 1 Longhorn replica |
| Ceph RGW | Ceph cluster | Data path (disks, NICs, DNS answers) | objects in RADOS pools |
| ExternalDNS | Authoritative DNS | Data path (disks, NICs, DNS answers) | records (provider API) |
| KubeVirt | CSI driver (Longhorn) | Data path (disks, NICs, DNS answers) | VM disks (PVCs) |
| KubeVirt | Cluster nodes | Data path (disks, NICs, DNS answers) | virt-launcher pods |
| KubeVirt | Open vSwitch | Data path (disks, NICs, DNS answers) | VM NIC taps on br-int (Multus, iface-id = Neutron port) |
| Open vSwitch | Cluster nodes | Data path (disks, NICs, DNS answers) | kernel datapath, Geneve tunnels |
| ovn-controller | Open vSwitch | Data path (disks, NICs, DNS answers) | OpenFlow: br-int flows |
| CDI | CSI driver (Longhorn) | Kubernetes API over HTTPS (CRDs, PVCs, watches) | PVC create, clone |
| Cinder volume driver | CSI driver (Longhorn) | Kubernetes API over HTTPS (CRDs, PVCs, watches) | PVC (Block), VolumeSnapshot |
| Cinder volume driver | KubeVirt | Kubernetes API over HTTPS (CRDs, PVCs, watches) | volume hotplug |
| Designate worker + sink | ExternalDNS | Kubernetes API over HTTPS (CRDs, PVCs, watches) | DNSEndpoint per recordset |
| Glance store driver | CDI | Kubernetes API over HTTPS (CRDs, PVCs, watches) | DataVolume upload (upload proxy), import, clone |
| Glance store driver | KubeVirt | Kubernetes API over HTTPS (CRDs, PVCs, watches) | VirtualMachineExport (download without keep_original) |
| Manila share driver | CSI driver (Longhorn) | Kubernetes API over HTTPS (CRDs, PVCs, watches) | PVC (RWX filesystem) |
| MariaDB Operator | MariaDB Galera | Kubernetes API over HTTPS (CRDs, PVCs, watches) | runs Galera; databases, users, grants; server certificates (own CA) |
| Masakari engine + monitors | KubeVirt | Kubernetes API over HTTPS (CRDs, PVCs, watches) | VMI delete, live migration |
| Masakari engine + monitors | Medik8s NHC + SNR | Kubernetes API over HTTPS (CRDs, PVCs, watches) | NodeHealthCheck, remediation status |
| Medik8s NHC + SNR | Kubernetes API server | Kubernetes API over HTTPS (CRDs, PVCs, watches) | fencing, out-of-service taint |
| Nova compute agent | Kubernetes API server | Kubernetes API over HTTPS (CRDs, PVCs, watches) | watch node allocatable |
| Nova conductor + scheduler | CDI | Kubernetes API over HTTPS (CRDs, PVCs, watches) | root DataVolume: clone of the image PVC |
| Nova conductor + scheduler | KubeVirt | Kubernetes API over HTTPS (CRDs, PVCs, watches) | VirtualMachine, Instancetype, Preference |
| Nova console proxy | KubeVirt | Kubernetes API over HTTPS (CRDs, PVCs, watches) | VNC and serial websockets, console log |
| RabbitMQ operators | RabbitMQ cluster | Kubernetes API over HTTPS (CRDs, PVCs, watches) | RabbitmqCluster, vhost, users, permissions |
| Rook operator | Ceph RGW | Kubernetes API over HTTPS (CRDs, PVCs, watches) | CephObjectStore: gateways, Keystone auth |
| Rook operator | Ceph cluster | Kubernetes API over HTTPS (CRDs, PVCs, watches) | CephCluster: mons, mgrs, OSDs |
| Swift storage | CSI driver (Longhorn) | Kubernetes API over HTTPS (CRDs, PVCs, watches) | one PVC per device (block StorageClass) |
| Zun API | Kubernetes API server | Kubernetes API over HTTPS (CRDs, PVCs, watches) | logs, exec, top, resize, metrics |
| Zun compute | Kubernetes API server | Kubernetes API over HTTPS (CRDs, PVCs, watches) | Pods (Kata RuntimeClass), NADs, Secrets |
| Zun compute agent | Kubernetes API server | Kubernetes API over HTTPS (CRDs, PVCs, watches) | Node allocatable, Pods |
| Zun wsproxy | Kubernetes API server | Kubernetes API over HTTPS (CRDs, PVCs, watches) | attach, exec (WebSockets) |
| cert-manager | all api services | Kubernetes API over HTTPS (CRDs, PVCs, watches) | TLS certificates (openkeel-ca) |
| Neutron FWaaS | OVN Northbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | pg_* Port_Groups, stateless ACLs |
| Neutron VPNaaS | OVN Southbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | lists VPN agents (Chassis_Private) |
| Neutron reconciler | OVN Northbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | repairs drift (maintenance loop) |
| Neutron server | OVN Northbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | NB writes: switches, ports, routers, ACLs, NAT, DHCP; LSP.up monitor |
| Neutron server | OVN Southbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | SB reads: Chassis, Chassis_Private (liveness, binding) |
| OVN Octavia provider | OVN Northbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | Load_Balancer rows; events, maintenance (OVSDB lock) |
| OVN Octavia provider | OVN Southbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | reads chassis, port bindings |
| VPNaaS agent | OVN Southbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | registers ovn-vpnagent, acks nb_cfg |
| ovn-controller | OVN Southbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | reads flows, claims Port_Binding, registers Chassis |
| ovn-controller | Open vSwitch | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | Open_vSwitch DB: br-int, tunnels, iface-id |
| ovn-northd | OVN Northbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | reads the logical configuration |
| ovn-northd | OVN Southbound DB | OVSDB over ssl: (OVN NB/SB mutual TLS, local OVS DB) | writes Logical_Flow, Port_Binding |
| CLI / SDK | Ingress / Gateway API | REST over HTTPS (Keystone token) | all APIs |
| Ceph RGW | Keystone | REST over HTTPS (Keystone token) | token validation, /v3/s3tokens (user rgw) |
| Cinder API | Glance | REST over HTTPS (Keystone token) | volume from image |
| Cinder API | Nova API | REST over HTTPS (Keystone token) | volume events |
| Designate worker + sink | Authoritative DNS | REST over HTTPS (Keystone token) | zone API, status polling |
| EC2 API | Cinder API | REST over HTTPS (Keystone token) | volumes, snapshots |
| EC2 API | Glance | REST over HTTPS (Keystone token) | AMIs |
| EC2 API | Keystone | REST over HTTPS (Keystone token) | ec2tokens (SigV4) |
| EC2 API | Neutron server | REST over HTTPS (Keystone token) | VPC, subnets, security groups |
| EC2 API | Nova API | REST over HTTPS (Keystone token) | instances |
| Glance | Barbican | REST over HTTPS (Keystone token) | image signatures |
| Glance | Glance store driver | REST over HTTPS (Keystone token) | in-process driver |
| Heat engine | Cinder API | REST over HTTPS (Keystone token) | OS::Cinder::* |
| Heat engine | Keystone | REST over HTTPS (Keystone token) | trusts, stack domain users |
| Heat engine | Neutron server | REST over HTTPS (Keystone token) | OS::Neutron::* |
| Heat engine | Nova API | REST over HTTPS (Keystone token) | OS::Nova::* |
| Ingress / Gateway API | Ceph RGW | REST over HTTPS (Keystone token) | swift.<domain>, s3.<domain> |
| Ingress / Gateway API | all api services | REST over HTTPS (Keystone token) | routes per service (HTTPS) |
| Ironic API | Ironic conductor | REST over HTTPS (Keystone token) | JSON-RPC deploy/clean/power |
| Ironic conductor | BMCs and switches | REST over HTTPS (Keystone token) | Redfish power, virtual media |
| Ironic conductor | Glance | REST over HTTPS (Keystone token) | image download (cache) |
| Ironic conductor | Neutron server | REST over HTTPS (Keystone token) | provisioning/tenant ports |
| Ironic conductor | ironic-python-agent | REST over HTTPS (Keystone token) | agent API: write image, clean, inspect |
| Masakari engine + monitors | Nova API | REST over HTTPS (Keystone token) | server state, host disable |
| Neutron VPNaaS | Neutron server | REST over HTTPS (Keystone token) | core and L3 calls: gateway ports, routes |
| Neutron server | Neutron FWaaS | REST over HTTPS (Keystone token) | proxy /v2.0/fwaas/*, same token |
| Neutron server | Neutron VPNaaS | REST over HTTPS (Keystone token) | proxy /v2.0/vpn/*, vpn-agents, same token |
| Neutron server | Nova API | REST over HTTPS (Keystone token) | network-vif-plugged |
| Neutron server | OVN Octavia provider | REST over HTTPS (Keystone token) | Octavia driver API (:9877) |
| Nova API | Barbican | REST over HTTPS (Keystone token) | encryption keys |
| Nova API | Cinder API | REST over HTTPS (Keystone token) | volume attach |
| Nova API | Glance | REST over HTTPS (Keystone token) | image metadata |
| Nova API | Neutron server | REST over HTTPS (Keystone token) | ports |
| Nova API | Nova console proxy | REST over HTTPS (Keystone token) | console log, with a token |
| Nova API | Placement | REST over HTTPS (Keystone token) | usages, quotas |
| Nova compute agent | Ironic API | REST over HTTPS (Keystone token) | nodes → Placement inventory (planned) |
| Nova compute agent | Placement | REST over HTTPS (Keystone token) | inventory, traits |
| Nova conductor + scheduler | Ironic API | REST over HTTPS (Keystone token) | bare metal flavors: provision nodes |
| Nova conductor + scheduler | Placement | REST over HTTPS (Keystone token) | allocation candidates, claims |
| OVN Octavia provider | Keystone | REST over HTTPS (Keystone token) | service token |
| OVN Octavia provider | Neutron server | REST over HTTPS (Keystone token) | /internal/lbaas status updates, ports, subnets |
| Skyline | Ceph RGW | REST over HTTPS (Keystone token) | containers, objects (Swift API, proxied) |
| Skyline | Cinder API | REST over HTTPS (Keystone token) | aggregated lists |
| Skyline | Glance | REST over HTTPS (Keystone token) | images |
| Skyline | Ingress / Gateway API | REST over HTTPS (Keystone token) | all APIs |
| Skyline | Keystone | REST over HTTPS (Keystone token) | login, catalog, system session |
| Skyline | Neutron server | REST over HTTPS (Keystone token) | extensions, ports, FWaaS, VPN, load balancers |
| Skyline | Nova API | REST over HTTPS (Keystone token) | aggregated lists |
| Swift proxy | Swift storage | REST over HTTPS (Keystone token) | internal account/container/object requests (ring lookup) |
| VPNaaS agent | Neutron VPNaaS | REST over HTTPS (Keystone token) | agent API :9697: services (ETag poll), status |
| Zun API | Placement | REST over HTTPS (Keystone token) | allocation candidates, claims |
| Zun compute | Cinder API | REST over HTTPS (Keystone token) | attachments → kubernetes_pvc |
| Zun compute | Neutron server | REST over HTTPS (Keystone token) | ports bound to host (compute:zun) |
| Zun compute agent | Placement | REST over HTTPS (Keystone token) | inventory (Node UID provider) |
| all api services | Keystone | REST over HTTPS (Keystone token) | token validation |
| ironic-python-agent | Ironic API | REST over HTTPS (Keystone token) | lookup, heartbeat |
| Neutron server | Neutron reconciler | SQL over TLS (MariaDB Galera) | reconciled from DB |
| Skyline | MariaDB Galera | SQL over TLS (MariaDB Galera) | settings, revoked tokens |
| all api services | MariaDB Galera | SQL over TLS (MariaDB Galera) | own schema (not Swift) |
| all workers services | MariaDB Galera | SQL over TLS (MariaDB Galera) | own schema (not Swift) |
Quelle: openkeel-diagram/openkeel-interactions.md