OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Deployment
Metrics, logs and the audit trail of every OpenKeel service in Grafana: an optional stack installed by okadm --grafana, the equivalent of Kolla's Prometheus, Grafana and central logging.
JSON logs and CADF audit events on stdout; /healthz, /readyz and /metrics on the admin port :9090
Prometheus Operator monitors scrape the services and data services; Alloy, a DaemonSet, reads every Pod log of its node
Prometheus for metrics; Loki for logs, with an app stream and an audit stream kept apart
OpenKeel dashboards in their own folder; PrometheusRule alerts sent through Alertmanager
Every Go module is built from the same template, so all of them emit the same signals in the same format.
Not there yet: request rates and latencies, database, cache and message counters, Go process metrics and OpenTelemetry traces are part of the module template's design, but the services do not export them today.
Everything goes in the openkeel-monitoring namespace. The chart versions are pinned in okadm's release manifest and built into the binary.
| Release | Chart | What | Lab | Production |
|---|---|---|---|---|
| kube-prometheus-stack | 92.10.1 (Prometheus Operator v0.94.1) | Prometheus Operator and its CRDs, Prometheus, Alertmanager, Grafana, kube-state-metrics, node-exporter, the Kubernetes dashboards and alerts | 1 replica of each; Prometheus keeps 2 days, without a volume | Prometheus ×2 (15 days, 50 Gi), Alertmanager ×3, Grafana with a 10 Gi volume, on the block StorageClass |
| loki | 7.3.0 (Loki 3.6.12) | Log store, queried by Grafana with LogQL | Single binary, 5 Gi volume | Simple scalable: 3 write, 3 read, 3 backend, gateway ×2; chunks and index in S3 |
| alloy | 1.13.1 (Alloy v1.20.1) | DaemonSet: every container log of its node to Loki, audit lines split out | 1 Pod per node | 1 Pod per node |
The umbrella chart adds these objects to the openkeel-infra release when monitoring is on.
| Object | Collects |
|---|---|
PodMonitor openkeel-services | The admin port of every OpenKeel Pod (APIs, workers, agents), labelled by service and component |
| MariaDB metrics | mysqld-exporter and its ServiceMonitor, added by the MariaDB operator: Galera cluster size, connections, queries, slow queries |
ServiceMonitor openkeel-rabbitmq | The rabbitmq_prometheus plugin, including per-queue metrics: messages ready, consumers, alarms |
ServiceMonitors openkeel-kubevirt, openkeel-longhorn | KubeVirt and Longhorn, when okadm plan finds them in the cluster |
ConfigMaps openkeel-dashboard-* | The OpenKeel dashboards, loaded by Grafana's sidecar into the OpenKeel folder |
The Kustomize lab (openkeel-lab) runs its own data services, without exporters: its Data services dashboard stays empty, while okadm install --mode lab --grafana gets them all.
Alloy routes each line by its top-level log_type field, so the audit trail is kept apart from the application logs, with its own retention.
| Stream | Lines | Lab | Production |
|---|---|---|---|
{stream="audit"} | CADF audit events ("log_type": "audit") | 30 days | 400 days |
{stream="app"} | Every other container line, OpenKeel or not | 7 days | 31 days |
Retention is enforced by Loki's compactor and can be changed in the okadm values file. Each line carries the labels namespace, pod, container, node, service and component.
| Dashboard | Data source | Shows |
|---|---|---|
| OpenKeel / Audit trail | Loki | Events, failures, 401, 403, failed Keystone authentications and deletes; failures by user and source IP; deletes and updates by user and resource type; the raw events. Filters: service, outcome, user, source IP |
| OpenKeel / Services | Prometheus, Loki | Scrape targets per service, audit counters, memory and CPU of each Pod (cAdvisor), log volume by level, errors by service, and a searchable log panel |
| OpenKeel / Data services | Prometheus | MariaDB Galera and RabbitMQ (queues backing up or without consumers, alarms) |
| Kubernetes / … | Prometheus | Those of kube-prometheus-stack: cluster, nodes, namespaces, Pods, workloads |
In Grafana, Explore, data source Loki: the CADF fields are extracted with LogQL. Here, the failed Keystone authentications.
{stream="audit", service="openkeel-keystone"}
| json outcome="payload.outcome",
initiator="payload.initiator.id",
ip="payload.initiator.host.address",
event_type="event_type"
| event_type="identity.authenticate"
| outcome="failure"Shipped as the PrometheusRule openkeel, on top of the Kubernetes alerts of kube-prometheus-stack.
| Alert | Severity | Fires when |
|---|---|---|
| OpenKeelAuditEventsDropped | critical | A service's audit queue was full: the trail has a gap |
| OpenKeelAuditEventsFailed | warning | An audit sink failed, for example RabbitMQ unreachable |
| OpenKeelServiceTargetDown | A service's metrics endpoint cannot be scraped | |
| OpenKeelServiceNoTarget | A service has no scrape target at all |
Alertmanager sends nowhere by default: set its receivers in the okadm values file.
Nothing is installed without the flag. okadm installs the stack right after Multus, before openkeel-infra: namespace, a random Grafana admin password, then kube-prometheus-stack, Loki and Alloy, each waited for. It remembers the flag: later installs and upgrades keep the stack up to date. Install, upgrade and access print Grafana's URL and the command that reads the password.
okadm install --mode lab --grafana # kind lab
okadm install --mode lab --grafana --ingress # Grafana at grafana.127.0.0.1.nip.io
okadm install --grafana --domain cloud.example.org
# or, with the Kustomize lab
GRAFANA=1 make lab-up| Topic | What to do |
|---|---|
| Loki object storage | Create the Secret openkeel-loki-s3 (endpoint, region, keys) and the buckets openkeel-loki-chunks and openkeel-loki-ruler before the install; okadm plan blocks without it. The Ceph RGW of okadm --ceph-s3 works too |
| Alert routing | Set Alertmanager's receivers |
| Control-plane targets | On Talos, expose the metrics of etcd, the scheduler and the controller manager, or turn those targets off |
| Existing Prometheus Operator | okadm plan warns about it. To keep it, install without --grafana, turn on the OpenKeel monitors and let that Prometheus select them |
| Grafana access | Ingress at grafana.<domain>, otherwise a port-forward; the admin password is random, in the Secret openkeel-grafana-admin |
| Values | One observability.<release> section per release in the same -f file as the rest of OpenKeel |
The services produce the trail; keeping it complete, intact, on time and readable for the required period is the platform's job.
| Duty | PCI-DSS v4.0 | ISO/IEC 27001:2022 | How |
|---|---|---|---|
| Ship the events off the node as they are written | 10.3.3 | A.8.15 | Alloy (or Fluent Bit, Vector, the OpenTelemetry Collector) with a disk buffer |
| Tamper-evident, write-once retention | 10.3.2, 10.3.3 | A.8.15 | A copy in object storage with object lock in compliance mode; Loki alone is not enough |
| 12 months, the last 3 immediately available | 10.5.1 | A.5.33, A.8.15 | Locked bucket of 400 days; Loki keeps the audit stream 400 days in production |
| Restricted read access | 10.3.1 | A.8.15, A.5.15 | Bucket policy, a Loki tenant or Grafana team for the audit stream |
| Synchronised clocks | 10.6.1 to 10.6.3 | A.8.17 | NTP on the nodes; node-exporter alerts on drift |
| Detect gaps | 10.7.1, 10.7.2 | A.8.15, A.8.16 | The audit alerts above, and the collector's own counters |
| Daily review | 10.4.1 | A.8.16 | A SIEM fed from the bucket or the collector; the Grafana dashboard |
Loki gives a searchable audit trail, not a tamper-proof archive: whoever administers the cluster can write to its storage.
monitoring.openstackExporter.enabled: true deploys openstack-exporter 1.7.0. Every 2 minutes it lists the resources of each API (servers, networks, volumes, images, Placement, agents), so the community OpenStack dashboards work as they are.
openstack_* seriesThe Prometheus of the stack is also a data source for OpenKeel itself: okadm points these services at it when --grafana is on.
| Reader | What it reads | For |
|---|---|---|
| CloudKitty (collector) | openstack-exporter series per project (tenant_id): instances, volume capacity, image size | Hourly rating, the FinOps / GreenOps page of Skyline |
openkeel-skyline (GET /extension/server_metrics) | KubeVirt kubevirt_vmi_* series of the project's namespace, VMs selected by the label openkeel.io/project-id | The Metrics page: CPU, memory (balloon driver), disk usage (QEMU guest agent) and disk I/O of the VMs |
| openkeel-skyline (Prometheus queries) | The queries of the console's monitoring pages | Administrator views of upstream Skyline |
See FinOps / GreenOps and CloudKitty and the Skyline additions.