OpenStack API
100% compatible with the Python APIs
OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent
The project
OpenKeel, the sovereign French Cloud solution of the inherent group, with a European reach: a Cloud built on Cloud Native, open source technologies, natively multi-tenant, designed to be SecNumCloud-ready, with REST APIs fully compatible with OpenStack's.
OpenKeel is developed by the inherent group, a French IT group expert in AI, cloud, cybersecurity and connectivity for businesses and public bodies.
Its sovereignty rests on open source code, distributed under the Apache License 2.0, on open APIs shared with the OpenStack ecosystem, and on a deployment on the customer's own Kubernetes clusters, in France and in Europe.
OpenKeel takes the OpenStack modules (Keystone, Nova, Neutron, Cinder, Glance, Manila…) and rewrites them in Go on top of Cloud Native technologies: Kubernetes, OVN, KubeVirt, CSI, Rook-Ceph, Medik8s, ExternalDNS.
The control plane (API, scheduling, database, bus) is rewritten; the data plane is handed to proven Kubernetes projects. OpenKeel deploys on Kubernetes clusters with the okadm CLI.
Tenant isolation comes from the OpenStack APIs (domains, projects, roles, quotas) and from the data plane: OVN networks per tenant, Neutron ports with port_security, NFS-Ganesha gateways inside the tenant network, one Kata microVM per container.
Tenants have no Kubernetes access: only the OpenKeel services create the objects (VirtualMachines, Pods, PVCs, NetworkAttachmentDefinitions).
SecNumCloud (ANSSI, framework 3.2) qualifies a Cloud service and the provider who runs it: organisation, people, premises and operations as much as technique. No software can be qualified on its own.
OpenKeel aims to be a SecNumCloud-ready foundation: encrypted flows, an audit trail on every API, tenant isolation, strong authentication and key management, with the documentation that lets the provider prove compliance during the audit.
100% compatible with the Python APIs
100% compatible with the data model
100% compatible with the messages
Replay the OpenStack test suites
CSI, NFS-Ganesha, OVN, KubeVirt
OpenStack repositories fetched and analysed
Precise specifications of the components
Starting with Placement and Keystone
Specification enriched, e2e tests integrated
Figures from the presentation; the workspace currently holds 38 reverse-spec folders and 25 Go modules.