OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
Deployment
An OpenKeel production or lab cluster in one command.
With no cluster configured, okadm offers to create a kind cluster. With --ingress, the Skyline console is served at skyline.127.0.0.1.nip.io. With --demo, it also creates the domain and project demo, ready to explore: a network and its router, a VM behind a load balancer, a container, floating IPs, and sample rated data when CloudKitty is installed.
okadm plan --mode lab
okadm install --mode lab --create-kind --ingress --demo
export OS_CLOUD=openkeel
ok server listexport OS_CLOUD=openkeel
ok server list
ok loadbalancer create ...okadm plan --mode lab
okadm install --mode lab \
--create-kind --ingress --demoThe flags of okadm install and their role. okadm upgrade takes the same ones for what it does (version, components, values, --grafana, --ingress); the cluster is chosen like kubectl does (--kubeconfig, $KUBECONFIG, --context, in-cluster account).
| Parameter | Default | Role |
|---|---|---|
--mode | production | production (3 nodes or more, role labels, three replicas, autoscaling) or lab (one node or more, one replica, small volumes, fallback backends) |
--version | latest of the manifest | OpenKeel version to install (okadm versions lists them) |
--components | all but the optional ones | Components to install, their dependencies added (nova brings Keystone, Placement, Glance, Neutron, Cinder); optional: Ironic, ovn-bgp-agent, CloudKitty, Magnum, and Designate in production |
--no-configurator | — | Leaves out openkeel-configurator, otherwise installed with OpenKeel in both modes |
--domain | lab: openkeel.example.com | Public DNS domain of the APIs and the console; required in production |
--storage-class | production: longhorn; lab: the cluster default | Block StorageClass of the databases and volumes |
-f, --values | — | Values file, repeatable (umbrella layout, one section per component): wins over every default |
--create-kind | — | Lab without a cluster: creates the kind cluster openkeel without asking (--kind-name to rename it) |
--install-prerequisites | on when okadm creates the cluster, and in production | Installs the operators the cluster lacks; =false only checks them |
--ingress | — | Publishes the APIs and the Skyline console: lab, Traefik on 127.0.0.1:80/443 and *.127.0.0.1.nip.io (--ingress-http-port, --ingress-https-port, --ingress-listen-address); production, the cluster's IngressClass (--ingress-class), Traefik installed when there is none |
--grafana | — | Observability stack: Prometheus Operator, Loki, Alloy, Grafana and the OpenKeel dashboards; kept by later runs |
--ceph-s3 | — | Rook, a Ceph cluster and its RGW gateway (S3 and Swift APIs) authenticated by Keystone |
--demo | — | Creates the domain and project demo with a VM, a load balancer and a container (below); --demo-external-network (default public) names the network of its router and floating IPs |
--no-default-flavors, --no-default-share-type | — | Skip the flavors m1.tiny to m1.xlarge and Manila's share type default |
--no-base-image, --no-public-network | — | Lab: skip the Alpine image in Glance and the shared external network public (203.0.113.0/24) |
--timeout | 15m | How long each step may wait for readiness |
--dry-run | — | Prints the steps and renders every chart, changes nothing |
--progress | auto | live (the running step redrawn with its state) or plain (a line every 30 s, for CI) |
--chart | the chart built into okadm | Local umbrella chart, to test a chart change without rebuilding okadm |
okadm plan runs the same checks without writing anything; okadm status, okadm access (URLs, accounts, port-forwards), okadm upgrade and okadm uninstall follow the installation.
Each step is idempotent: running okadm install again changes nothing when everything is in place, and resumes an interrupted install.
Checks the Kubernetes version, nodes, operators, StorageClass; prints the command that fixes each gap
In a lab without a cluster: created through the kind library, ports 80 and 443 with --ingress
Installs the missing prerequisites, waits for CRDs and Deployments
Embedded umbrella chart, split: openkeel-infra then one release per component
MariaDB Galera in TLS, RabbitMQ and vhost; database, accounts and secrets per component; the internal CA and certificates
openkeel-* releases in dependency order, schema migrations
m1.tiny to m1.xlarge; Alpine 3.24 cloud-init image in Glance
Skyline console URL, Keystone, admin account, exported clouds.yaml
The automated steps of okadm install, in order. Each waits for what it creates (CRDs Established, Deployments Available, Helm releases and their migration Jobs) and is unchanged when the cluster already matches.
| Step | Production | Lab |
|---|---|---|
| Cluster | The existing cluster: 3 Ready nodes or more, hardened role labels (control plane, compute, containers, network, storage), zones checked | Created with the kind library when there is none (--create-kind): one node, kindnet, local-path; with --ingress, ports 80 and 443 forwarded; the OpenKeel images of the local container engine loaded into the node |
| Operators | Installed when missing: cert-manager, MariaDB and RabbitMQ operators, KubeVirt and CDI (no emulation), metrics-server (kubelet certificates verified), Traefik behind a LoadBalancer when no IngressClass is usable | The same, plus PowerDNS and ExternalDNS; KubeVirt emulates without /dev/kvm; metrics-server with --kubelet-insecure-tls; Traefik on hostPorts |
| Namespace, Multus, CRDs | Namespace openkeel (Pod Security baseline enforced, restricted warned), Multus thick plugin, CRDs OpenKeelTenant and OpenKeelCustomer | The same, plus the openkeel-ovn placeholder attachment (the lab has no Kube-OVN) |
Observability (--grafana) | Prometheus Operator, Loki on S3, Alloy, Grafana, before the data services whose monitors need their CRDs | The same stack with one replica each |
| Data services | openkeel-infra: MariaDB Galera and RabbitMQ in TLS (chart sizes, 3 replicas), a database, accounts and secrets per component, the internal CA; RabbitMQ's topology operator made to trust it; every object waited for Ready | One replica, MariaDB 5 GiB, RabbitMQ 2 GiB; the lab's NetworkPolicy fixes for kindnet |
| Platform glue | — | CDI StorageProfile for local-path, CDI upload proxy CA for Glance, OVN Northbound and Southbound databases (ovn-central) for Neutron |
| Components | One Helm release per component, in dependency order, chart defaults (3 replicas, autoscaling), node placement by role labels; openkeel-configurator | Every replica at 1, no autoscaling, volumes ReadWriteOnce at most 5 GiB, fallback backends (Manila dummy driver, Zun on runc without Kata, Nova emulated) |
| Catalog content | Flavors m1.tiny to m1.xlarge; Manila share type default | The same, plus the Alpine 3.24.3 cloud-init image (checked with SHA-512) and the shared external network public (203.0.113.0/24) |
Object storage (--ceph-s3) | Rook, Ceph and RGW (S3 and Swift) authenticated by Keystone: 3 monitors, pools replicated 3 times across hosts, 2 gateways | The same with one monitor, one replica and one gateway, the OSD on a loop device of the kind node |
Publishing (--ingress) | Ingresses of the APIs on the cluster's IngressClass, <service>.<domain> | Traefik, skyline.127.0.0.1.nip.io and the APIs on *.127.0.0.1.nip.io |
Demo (--demo) | The demo project on the external network given by --demo-external-network | The demo project on public; with CloudKitty, sample rated data |
| Summary | Every step done, unchanged or failed with its cause; target, mode and components recorded in the ConfigMap openkeel-okadm-state; an interrupted run resumes where it stopped | The same |
Installed by okadm in a lab; in production, okadm plan checks them and prints the command for the tested version.
Flavors created by default (hw_rng:allowed and resources:DISK_GB=0, root disks are PVCs) and an Alpine 3.24.3 cloud-init image registered in Glance, checked with SHA-512.
| Name | vCPU | RAM | Disk |
|---|---|---|---|
| m1.tiny | 1 | 512 MB | 1 GB |
| m1.small | 1 | 2 GB | 20 GB |
| m1.medium | 2 | 4 GB | 40 GB |
| m1.large | 4 | 8 GB | 80 GB |
| m1.xlarge | 8 | 16 GB | 160 GB |
Console: skyline.127.0.0.1.nip.io with --ingress, otherwise kubectl port-forward svc/openkeel-skyline-api 9998. Account admin, project admin, domain Default; password in the openkeel-keystone-admin secret.
--demo ends the install with a complete project to explore in Skyline and with the CLIs. It needs Keystone, Glance, Cinder, Neutron, ovn-octavia-provider, Nova and Zun; what already exists under its name is kept, so running it again completes an interrupted demo.
| Resource | What okadm creates |
|---|---|
Domain demo | Through the OpenKeelCustomer demo (reconciled by keystone-customers): the domain, its manager and the project |
User demo | Manager of the domain and of the project, with the password of the user admin (secret openkeel-keystone-admin); admin gets the admin role in the project |
Project demo | Its default security group opens ICMP, SSH and HTTP |
| Network | demo-net and demo-subnet (192.168.0.0/24, DHCP), router demo-router to the external network |
VM demo-vm | Flavor m1.tiny, the Alpine base image, a 20 GB data volume demo-vm-data, user alpine (password alpine) made by cloud-init for the console and SSH, a floating IP |
Load balancer demo-lb | OVN load balancer, TCP 80, the VM as member, a floating IP on its VIP |
Container nginx | Zun container with a 1 GB volume on /data |
| Rated data (with CloudKitty) | One frame per day from the first day of last month to yesterday, a VM deleted last month, floating IPs, the image: Skyline's FinOps / GreenOps page shows both months; then the project is rated every hour |
In a lab, floating IPs come from TEST-NET-3 (203.0.113.0/24), documentation addresses never routed, and the lab's OVN has no data plane: the VM boots (emulated) and its console works, but nothing can reach it over the network.