> ## Documentation Index
> Fetch the complete documentation index at: https://docs.internal.nscale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Relationship: OpenStack (Ironic, Nova, Placement, Keystone)

> OpenStack services Fleet Manager observes and drives: Ironic, Nova, Placement and Keystone.

* **Kind:** Observation
* **Version:** 1
* **Fleet Manager owner:** Fleet Manager squad, #fleet-manager-chat (individual claimant pending)
* **Counterpart owner:** unassigned, Infrastructure Engineering (IaaS substrate); whether one owner covers all
  deployments or one per deployment set is to be confirmed with them
* **Last reviewed:** 2026-09-09

## What flows

The per-satellite `openstack-agent` (`src/fleet_manager/agents/openstack/`, ADR-0036) polls [Ironic](../start-here/glossary#ironic) nodes every
60 s and mirrors provision and power state into [device](../start-here/glossary#node) conditions (`ProvisioningHealthy`, `MaintenanceClear`,
`Enrolled`, `InValidationPool`, `InstanceAllocated`, `CustomerAllocated`, `CustomerReady`) from which the hub
derives `operational_status` (ADR-0024). It sweeps assigned nodes every 5 min to rerun Ironic reconciliation and detect orphaned [Nova](../start-here/glossary#nova)
instances, and resyncs impairment state every 15 min, writing and removing the
[Placement](../start-here/glossary#placement) `CUSTOM_CUSTOMER_READY` trait for quarantine and release.

Workflows call the same services through `src/fleet_manager/core/clients/openstack/`: enrolment, cleaning and
inspection against Ironic; instance create for image-node and [SLURM](../start-here/glossary#slurm) adoption against Nova; the Ironic-direct
deploy path (ADR-0042) for standalone-Ironic sites. Application-credential access rules are the contract in
[OpenStack Application Credentials](../deployment-guide/new-site-deployment/openstack-application-credentials).

## What breaks if this changes

An Ironic API change or a missing access rule fails enrolment, cleaning and deploy workflows at runtime. A
Placement outage leaves quarantine and release half-applied.

## Enforcement

* **Principal:** `ironic-agent-<site>` and `temporal-worker-<site>`.
* **Mechanism:** towards Fleet Manager, FM OAuth clients (private-key JWT) in the hub chart satellite roster;
  towards OpenStack, the per-site application credentials in `clouds.yaml` held in the site [1Password](../start-here/glossary#1password) vault (see
  [OpenStack Application Credentials](../deployment-guide/new-site-deployment/openstack-application-credentials)).
  A Keystone 401 or a credential rotation is the OpenStack side, not the Fleet Manager client.
* Satellite roster client `ironic-agent-<site>` (scopes `device:update`, `device-condition:create`,
  `operations:read|write`) and `temporal-worker-<site>` in `deployment/charts/hub/values.yaml`.
* Access rules: the application-credentials page above; the PR checklist in `AGENTS.md` requires it to move
  with any new Ironic, Nova or Placement call.
* Settings: `src/fleet_manager/settings/agents/openstack.py`.

## Gaps

* No written notice period from Infrastructure Engineering for OpenStack upgrades.
* Standalone-Ironic sites have no Nova, so the Placement trait path does not apply there; the file does not yet
  describe that variant per site.

## Change log

* 2026-09-09 v1: created; describes present behaviour.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.