FAQ

The sovereign French Cloud solution of the inherent group, with a European reach. It rewrites the OpenStack services in Go on top of Cloud Native technologies (Kubernetes, OVN, KubeVirt, CSI). Its REST APIs are compatible with OpenStack's and it deploys on Kubernetes with the okadm CLI.

The inherent group, a French IT group expert in AI, cloud, cybersecurity and connectivity for businesses and public bodies.

The Apache License 2.0, the license of OpenStack: the code can be used, modified and redistributed, commercially too, with an explicit patent grant; the license and the copyright notices go with every copy, and changes are marked as such.

SecNumCloud (ANSSI) qualifies a service and its provider, not a piece of software. OpenKeel is designed to be SecNumCloud-ready: every internal flow in TLS, a CADF audit trail on every API, OpenStack RBAC, Barbican with an HSM, Kata isolation for containers, signed images with an SBOM on a controlled registry. What is compliant today and what is left to evolve, requirement by requirement, is on SecNumCloud-ready.

Yes: each component keeps the paths, parameters, HTTP codes, error bodies, microversions and policies of the original. Clients, SDKs, Terraform, Tempest and Skyline see no difference. Known gaps are listed in each module's docs/CONFORMANCE.md.

Tenants are Keystone's (domains, projects, roles, quotas). They have no Kubernetes access. VMs have no interface on the Pod network: their NICs are Neutron ports in OVN, protected by port_security and a CNI guard. Manila and Zun isolate each tenant too (an NFS gateway inside the tenant network, a Kata microVM per container).

Go is the language of Kubernetes, etcd, containerd, Helm, Prometheus and KubeVirt. It gives static binaries, distroless images without a shell, and native access to client-go, the Helm SDK and OVSDB.

With okadm: okadm plan checks the cluster, okadm install installs the operators, data services and components in order, okadm upgrade upgrades one component at a time. In a lab, okadm can create a kind cluster.

Any array or storage software with a block CSI driver: Rook-Ceph (RBD), Longhorn, NetApp (Trident), Huawei Dorado, and Pure Storage FlashArray through OpenKeel's own CSI driver. Each one is a Cinder backend defined by a StorageClass; tenants choose it through volume types. See Block storage for the validation status of each driver.

It is not rewritten: KubeVirt runs the VMs, OVN and Open vSwitch switch the networks, CSI (Longhorn, Pure Storage) provides the volumes, Rook-Ceph the object storage, ExternalDNS the DNS and Medik8s node remediation.

Not yet. Ironic stays upstream Python, packaged in an OpenKeel chart. Heat has its reverse-spec; only its stack and orchestration commands are rewritten in the ok client.

Through five levels of tests: unit, Galera integration, e2e replay of the exchanges recorded against the Python service, differential CLI between ok and openstack, and Tempest with its plugins.

From the generate-reverse-spec skill, which reads the upstream Python code of a branch (stable/2026.2) and produces a sourced specification and a rewrite pack. The 38 reverse-specs are published in the Resources section.